Edit tour

Windows Analysis Report
SPECIFICATIONS.exe

Overview

General Information

Sample name:	SPECIFICATIONS.exe
Analysis ID:	1572499
MD5:	f55f417cb656aeddb7e17504bbf28102
SHA1:	844a465a09bfe6ea4d75f6dfad9f318538ae1891
SHA256:	f9f3ab7e1e35b79ad0451c58423219c56e9222c60c54ef78e608de0796ca5347
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SPECIFICATIONS.exe (PID: 6484 cmdline: "C:\Users\user\Desktop\SPECIFICATIONS.exe" MD5: F55F417CB656AEDDB7E17504BBF28102)

conhost.exe (PID: 6600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 6640 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

CasPol.exe (PID: 5880 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

jsc.exe (PID: 528 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

jsc.exe (PID: 1560 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

WerFault.exe (PID: 6584 cmdline: C:\Windows\system32\WerFault.exe -u -p 6484 -s 1216 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

newapp.exe (PID: 7508 cmdline: "C:\Users\user\AppData\Roaming\newapp\newapp.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

conhost.exe (PID: 7520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

newapp.exe (PID: 7720 cmdline: "C:\Users\user\AppData\Roaming\newapp\newapp.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.ercolina-usa.com", "Username": "ben@ercolina-usa.com", "Password": "nXe0M~WkW&nJ"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000005.00000002.4502632182.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.4501166919.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.4501166919.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.4502632182.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.4502632182.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SPECIFICATIONS.exe PID: 6484	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SPECIFICATIONS.exe PID: 6484	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SPECIFICATIONS.exe PID: 6484	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SPECIFICATIONS.exe PID: 6484	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: jsc.exe PID: 528	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jsc.exe PID: 528	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.jsc.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.jsc.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.jsc.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x359dc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35a4e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35ad8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35b6a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35bd4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35c46:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35cdc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35d6c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.jsc.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32bec:$s2: GetPrivateProfileString 0x32272:$s3: get_OSFullName 0x33969:$s5: remove_Key 0x33b29:$s5: remove_Key 0x34aa1:$s6: FtpWebRequest 0x359be:$s7: logins 0x35f30:$s7: logins 0x38c41:$s7: logins 0x38cf3:$s7: logins 0x3a7be:$s7: logins 0x3988d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33bdc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33c4e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33cd8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d6a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33dd4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33e46:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33edc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33f6c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30dec:$s2: GetPrivateProfileString 0x30472:$s3: get_OSFullName 0x31b69:$s5: remove_Key 0x31d29:$s5: remove_Key 0x32ca1:$s6: FtpWebRequest 0x33bbe:$s7: logins 0x34130:$s7: logins 0x36e41:$s7: logins 0x36ef3:$s7: logins 0x389be:$s7: logins 0x37a8d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33bdc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33c4e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33cd8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d6a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33dd4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33e46:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33edc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33f6c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30dec:$s2: GetPrivateProfileString 0x30472:$s3: get_OSFullName 0x31b69:$s5: remove_Key 0x31d29:$s5: remove_Key 0x32ca1:$s6: FtpWebRequest 0x33bbe:$s7: logins 0x34130:$s7: logins 0x36e41:$s7: logins 0x36ef3:$s7: logins 0x389be:$s7: logins 0x37a8d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x359dc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35a4e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35ad8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35b6a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35bd4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35c46:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35cdc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35d6c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32bec:$s2: GetPrivateProfileString 0x32272:$s3: get_OSFullName 0x33969:$s5: remove_Key 0x33b29:$s5: remove_Key 0x34aa1:$s6: FtpWebRequest 0x359be:$s7: logins 0x35f30:$s7: logins 0x38c41:$s7: logins 0x38cf3:$s7: logins 0x3a7be:$s7: logins 0x3988d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x359dc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x72c24:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35a4e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x72c96:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35ad8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x72d20:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35b6a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x72db2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35bd4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x72e1c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35c46:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x72e8e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35cdc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x72f24:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35d6c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x72fb4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32bec:$s2: GetPrivateProfileString 0x6fe34:$s2: GetPrivateProfileString 0x32272:$s3: get_OSFullName 0x6f4ba:$s3: get_OSFullName 0x33969:$s5: remove_Key 0x33b29:$s5: remove_Key 0x70bb1:$s5: remove_Key 0x70d71:$s5: remove_Key 0x34aa1:$s6: FtpWebRequest 0x71ce9:$s6: FtpWebRequest 0x359be:$s7: logins 0x35f30:$s7: logins 0x38c41:$s7: logins 0x38cf3:$s7: logins 0x3a7be:$s7: logins 0x72c06:$s7: logins 0x73178:$s7: logins 0x75e89:$s7: logins 0x75f3b:$s7: logins 0x77a06:$s7: logins 0x3988d:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\newapp\newapp.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe, ProcessId: 528, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newapp

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.ercolina-usa.com", "Username": "ben@ercolina-usa.com", "Password": "nXe0M~WkW&nJ"}

Multi AV Scanner detection for submitted file

Source: SPECIFICATIONS.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SPECIFICATIONS.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SPECIFICATIONS.exe PID: 6484, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: SPECIFICATIONS.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WERE724.tmp.dmp.9.dr
Source:	Binary string: o0C:\Windows\mscorlib.pdb1 source: newapp.exe, 0000000B.00000002.2170556471.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp, newapp.exe, 0000000E.00000002.2251666294.0000000000958000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: uC:\Windows\dll\mscorlib.pdb source: newapp.exe, 0000000E.00000002.2251865825.0000000000AF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbx source: newapp.exe, 0000000B.00000002.2170820592.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERE724.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: jsc.pdb source: newapp.exe, 0000000B.00000000.2166396796.0000000000882000.00000002.00000001.01000000.00000008.sdmp, newapp.exe.5.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERE724.tmp.dmp.9.dr
Source:	Binary string: jsc.pdb8 source: newapp.exe, 0000000B.00000000.2166396796.0000000000882000.00000002.00000001.01000000.00000008.sdmp, newapp.exe.5.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.pdb0 source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Management.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Drawing.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Management.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: newapp.exe, 0000000B.00000002.2170820592.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE724.tmp.dmp.9.dr

Source: Joe Sandbox View	IP Address: 192.254.225.136 192.254.225.136
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.ercolina-usa.com

Source: jsc.exe, 00000005.00000002.4502632182.00000000030A5000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4502632182.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4502632182.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ercolina-usa.com
Source: jsc.exe, 00000005.00000002.4502632182.00000000030A5000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4502632182.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4502632182.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.ercolina-usa.com
Source: jsc.exe, 00000005.00000002.4502632182.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: SPECIFICATIONS.exe, 00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4501166919.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: SPECIFICATIONS.exe, 00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4501166919.0000000000402000.00000040.00000400.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4502632182.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: jsc.exe, 00000005.00000002.4502632182.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: jsc.exe, 00000005.00000002.4502632182.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, SKTzxzsJw.cs	.Net Code: KdRT1gFnIpl
Source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack, SKTzxzsJw.cs	.Net Code: KdRT1gFnIpl

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Code function: 0_2_00007FF848F1F619	0_2_00007FF848F1F619
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Code function: 0_2_00007FF848F12A2C	0_2_00007FF848F12A2C
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Code function: 0_2_00007FF848F22D79	0_2_00007FF848F22D79
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Code function: 0_2_00007FF848F23442	0_2_00007FF848F23442
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Code function: 0_2_00007FF848F1D44D	0_2_00007FF848F1D44D
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Code function: 0_2_00007FF848F1A4D0	0_2_00007FF848F1A4D0
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Code function: 0_2_00007FF848F16FB8	0_2_00007FF848F16FB8
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Code function: 0_2_00007FF848F2348F	0_2_00007FF848F2348F
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Code function: 0_2_00007FF848FF0000	0_2_00007FF848FF0000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_02D94A68	5_2_02D94A68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_02D9EB20	5_2_02D9EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_02D93E50	5_2_02D93E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_02D94198	5_2_02D94198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_02D91980	5_2_02D91980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_02D9ADB0	5_2_02D9ADB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A047A4	5_2_06A047A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A06A12	5_2_06A06A12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A01B78	5_2_06A01B78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A01F30	5_2_06A01F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A05D42	5_2_06A05D42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A05D48	5_2_06A05D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A156A8	5_2_06A156A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A166D8	5_2_06A166D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A17E60	5_2_06A17E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A13568	5_2_06A13568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A1B2FF	5_2_06A1B2FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A1C260	5_2_06A1C260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A17780	5_2_06A17780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A12728	5_2_06A12728
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A1E490	5_2_06A1E490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A15DCF	5_2_06A15DCF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A10040	5_2_06A10040

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6484 -s 1216

Source: SPECIFICATIONS.exe

Static PE information: No import functions for PE file found

Source: SPECIFICATIONS.exe, 00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4050351b-3b81-4030-83d1-4403e211abfe.exe4 vs SPECIFICATIONS.exe
Source: SPECIFICATIONS.exe, 00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEfuguhumagegucimF vs SPECIFICATIONS.exe
Source: SPECIFICATIONS.exe	Binary or memory string: OriginalFilenamePatekPorot.exe4 vs SPECIFICATIONS.exe

Source: 5.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: SPECIFICATIONS.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9991910626601196

Source: SPECIFICATIONS.exe, --------.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@15/10@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File created: C:\Users\user\AppData\Roaming\newapp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6484
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\2877ffe5-0ded-49ae-944b-8e216f136eac

Jump to behavior

Source: SPECIFICATIONS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SPECIFICATIONS.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SPECIFICATIONS.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe

File read: C:\Users\user\Desktop\SPECIFICATIONS.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SPECIFICATIONS.exe "C:\Users\user\Desktop\SPECIFICATIONS.exe"
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6484 -s 1216
Source: unknown	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe "C:\Users\user\AppData\Roaming\newapp\newapp.exe"
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe "C:\Users\user\AppData\Roaming\newapp\newapp.exe"
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SPECIFICATIONS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SPECIFICATIONS.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WERE724.tmp.dmp.9.dr
Source:	Binary string: o0C:\Windows\mscorlib.pdb1 source: newapp.exe, 0000000B.00000002.2170556471.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp, newapp.exe, 0000000E.00000002.2251666294.0000000000958000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: uC:\Windows\dll\mscorlib.pdb source: newapp.exe, 0000000E.00000002.2251865825.0000000000AF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbx source: newapp.exe, 0000000B.00000002.2170820592.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERE724.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: jsc.pdb source: newapp.exe, 0000000B.00000000.2166396796.0000000000882000.00000002.00000001.01000000.00000008.sdmp, newapp.exe.5.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERE724.tmp.dmp.9.dr
Source:	Binary string: jsc.pdb8 source: newapp.exe, 0000000B.00000000.2166396796.0000000000882000.00000002.00000001.01000000.00000008.sdmp, newapp.exe.5.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.pdb0 source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Management.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Drawing.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Management.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: newapp.exe, 0000000B.00000002.2170820592.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdb source: WERE724.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE724.tmp.dmp.9.dr

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Code function: 0_2_00007FF848F17967 push ebx; retf	0_2_00007FF848F1796A
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Code function: 0_2_00007FF848FF0000 push esp; retf 4810h	0_2_00007FF848FF0312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A05350 pushfd ; ret	5_2_06A05669
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A0AF01 push es; ret	5_2_06A0AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A068E0 pushad ; retf	5_2_06A068E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A068E2 push esp; retf	5_2_06A068E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A05662 pushfd ; ret	5_2_06A05669
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 5_2_06A0F550 push es; ret	5_2_06A0F560

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File created: C:\Users\user\AppData\Roaming\newapp\newapp.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run newapp			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run newapp			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File opened: C:\Users\user\AppData\Roaming\newapp\newapp.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SPECIFICATIONS.exe PID: 6484, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA72B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLP
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA72B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAMEP

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Memory allocated: 2BDA6F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Memory allocated: 2BDBF250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 4C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 2740000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	File opened / queried: C:\WINDOWS\system32\drivers\vmmouse.sys	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk\Enum name: 0	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	File opened / queried: C:\WINDOWS\system32\drivers\vmhgfs.sys	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	File opened / queried: C:\WINDOWS\system32\drivers\VBoxMouse.sys	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598778	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598449	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598338	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596662	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596202	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595539	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595260	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594062	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 2498			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 7347			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7332	Thread sleep count: 2498 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7332	Thread sleep count: 7347 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -599327s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -599108s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -598778s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -598449s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -598338s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -597764s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -597546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -596999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -596662s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -596421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -596202s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -596093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -595874s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -595764s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -595656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -595539s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -595421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -595260s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -595155s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -595046s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -594937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -594827s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -594718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -594499s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -594390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -594281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -594171s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7316	Thread sleep time: -594062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 7572	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 7768	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 599108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598778	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598449	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598338	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596662	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596202	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595539	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595260	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 595046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 594062	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA72B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMUP
Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA72B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware ToolsP
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA72B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &C:\WINDOWS\system32\drivers\vmhgfs.sysP
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA72B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREP
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA72B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareP
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA7251000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: )C:\WINDOWS\system32\drivers\VBoxMouse.sysP
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA72B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\P
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA72B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIP
Source: jsc.exe, 00000005.00000002.4506819412.0000000006140000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA72B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'C:\WINDOWS\system32\drivers\vmmouse.sysP
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: SPECIFICATIONS.exe, 00000000.00000002.2344463767.000002BDA72B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: SPECIFICATIONS.exe, --------.cs	Reference to suspicious API methods: GetProcAddress(_05BC_05FE_FB1E_05FB_05B8_05C6_05C8_05BA_05C8, _05BC_05C5_0597_05B1_05A9_05C8_05C5_059C_FB1E_05F5_05ED_05BA_05ED_0596_05BD_05B5_05FC_05BB_05B9_05CA_0591)
Source: SPECIFICATIONS.exe, --------.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (UIntPtr)(ulong)_059A_05CE_059A_05F7_05ED_05F8_05FE_0590_05C9_05B1_0599_05AA.Length, 64u, out var _05B4_05CF_059D_05A3_05B5)
Source: SPECIFICATIONS.exe, --------.cs	Reference to suspicious API methods: LoadLibrary(array5[0])
Source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, zOS.cs	Reference to suspicious API methods: _120HqGy.OpenProcess(_2pIt.DuplicateHandle, bInheritHandle: true, (uint)iVE.ProcessID)

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: D9D008	Jump to behavior

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior

Source: jsc.exe, 00000005.00000002.4502632182.00000000030A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q8<b>[ Program Manager]</b> (10/12/2024 21:24:49)<br>{Win}THbq
Source: jsc.exe, 00000005.00000002.4502632182.00000000030A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: jsc.exe, 00000005.00000002.4502632182.00000000030A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q
Source: jsc.exe, 00000005.00000002.4502632182.00000000030A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q3<b>[ Program Manager]</b> (10/12/2024 21:24:49)<br>
Source: jsc.exe, 00000005.00000002.4502632182.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <html>Time: 12/27/2024 10:27:17<br>User Name: user<br>Computer Name: 675052<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 8.46.123.175<br><hr><b>[ Program Manager]</b> (10/12/2024 21:24:49)<br>{Win}r</html>
Source: jsc.exe, 00000005.00000002.4502632182.00000000030A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q9<b>[ Program Manager]</b> (10/12/2024 21:24:49)<br>{Win}rTHbq

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe	Queries volume information: C:\Users\user\Desktop\SPECIFICATIONS.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Queries volume information: C:\Users\user\AppData\Roaming\newapp\newapp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Queries volume information: C:\Users\user\AppData\Roaming\newapp\newapp.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SPECIFICATIONS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 5.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4502632182.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4501166919.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4502632182.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SPECIFICATIONS.exe PID: 6484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 528, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 5.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4501166919.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4502632182.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SPECIFICATIONS.exe PID: 6484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 528, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 5.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb72dbf08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SPECIFICATIONS.exe.2bdb729ecc0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4502632182.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4501166919.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4502632182.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SPECIFICATIONS.exe PID: 6484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 528, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	212 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Obfuscated Files or Information	1 Credentials in Registry	341 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	21 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	261 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	261 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SPECIFICATIONS.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
SPECIFICATIONS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\newapp\newapp.exe	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
ercolina-usa.com	192.254.225.136	true	true	unknown
api.ipify.org	104.26.13.205	true	false	high
ftp.ercolina-usa.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org	SPECIFICATIONS.exe, 00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4501166919.0000000000402000.00000040.00000400.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4502632182.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://upx.sf.net	Amcache.hve.9.dr	false	high
https://account.dyn.com/	SPECIFICATIONS.exe, 00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4501166919.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://api.ipify.org/t	jsc.exe, 00000005.00000002.4502632182.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	jsc.exe, 00000005.00000002.4502632182.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ftp.ercolina-usa.com	jsc.exe, 00000005.00000002.4502632182.00000000030A5000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4502632182.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4502632182.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ercolina-usa.com	jsc.exe, 00000005.00000002.4502632182.00000000030A5000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4502632182.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000005.00000002.4502632182.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.254.225.136	ercolina-usa.com	United States		46606	UNIFIEDLAYER-AS-1US	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572499
Start date and time:	2024-12-10 16:28:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SPECIFICATIONS.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@15/10@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 90% Number of executed functions: 104 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22, 20.190.147.2, 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target newapp.exe, PID 7508 because it is empty
Execution Graph export aborted for target newapp.exe, PID 7720 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: SPECIFICATIONS.exe

Simulations

Behavior and APIs

Time	Type	Description
10:29:05	API Interceptor	10118940x Sleep call for process: jsc.exe modified
10:29:30	API Interceptor	1x Sleep call for process: WerFault.exe modified
16:29:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run newapp C:\Users\user\AppData\Roaming\newapp\newapp.exe
16:29:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run newapp C:\Users\user\AppData\Roaming\newapp\newapp.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.254.225.136	TECHNICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse
	uLFOeGZaJS.exe	Get hash	malicious	AgentTesla	Browse
	RICHIESTA D'OFFERTA.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	QUOTATION#09678.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE SPCIFICIATIONS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	LISTA DE COTIZACIONES.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	QUOTATION#5400.exe	Get hash	malicious	AgentTesla	Browse
	QUOTATION#2800-QUANTUM MACTOOLS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	QUOTATION#2800-QUANTUM MACTOOLS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	2JHGWjmJ46.exe	Get hash	malicious	AgentTesla	Browse
104.26.13.205	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	EEMsLiXoiTzoaDd.scr	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Statement 2024-11-29 (K07234).exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	1mr7lpFIVI.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	jKDBppzWTb.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	enyi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	x.ps1	Get hash	malicious	PureLog Stealer, Quasar	Browse	104.26.12.205
	file.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	Xeno Executor.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ST07933.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	http://abercombie.com	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://listafrica.org/Receipt.html	Get hash	malicious	WinSearchAbuse	Browse	172.64.41.3
	https://github.com/Matty77o/malware-samples-m-h/blob/main/TheTrueFriend.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01	Get hash	malicious	Unknown	Browse	104.26.1.90
	https://webradiojaguar.net/FNB-POP.pdf	Get hash	malicious	Unknown	Browse	1.1.1.1
	PO2412010.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	https://zfrmz.com/wE0Jw9HNvGeKZ1fn5cBU	Get hash	malicious	Unknown	Browse	104.17.25.14
	7gxaFDUSOD.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
UNIFIEDLAYER-AS-1US	ExternalREMITTANCE ACH SCHEDULED 1210241424bec0c449d38092c0dbd844252d73 (24.0 KB).msg	Get hash	malicious	Unknown	Browse	69.49.245.172
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	162.215.31.89
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	198.58.93.231
	https://xxx.cloudlawservices.com/fROBJ/	Get hash	malicious	HTMLPhisher	Browse	69.49.230.198
	Play_VM-NowCRQW.html	Get hash	malicious	HTMLPhisher	Browse	69.49.230.198
	https://webservice.ucampaign.unear.net/UmailTracking/t.aspx?p=64620006&c=MTI2NjMxOA==&up=46435316&e=jlim@vvblawyers.com&l=MTczODQ=&i=1126&u=aHR0cHM6Ly9zcGhleGFtcy5jb20vLndlbGwta25vdy8/MHM1N2RiPU1UTW1NVE1tTVRNbU1UTW1RakVtUmpRbWIySnhkRWN6SmtRMEprMTFiSGR5VkdoSGVVdFpMaTQ1U2pOWU5sSnlhbVk2Y2tZMEpqTXpKblY1Wm5VdWIyWmxaV3BwTXpNbVJUUW1kSFJpYldReE15WnZZbkYwUkRRbVFqRW1SalFtYlc1MWFVY3pKa1EwSmtJeEprWTBKbnBsY0dOSE15WkVOQ1pDTVNaR05DWjZaWEJqUkRRbVFqRW1SalFtWldKbWFVY3pKa1EwSmtJeEprWTBKbVp0ZW5WMFJ6TW1SRFFtTVRNbU1UTW1NVE1tTVRNbVFqRW1SVGdtTVRNbU1UTW1NVE1tTVRNbU1UTW1NVE1tTVRNbU1UTW1RakVtUXpRbWIyWmxaV3BwTVRNbVFqUW1lblZxYldwamFuUnFkekV6SmpFekpqRXpKakV6SmpFekpqRXpKakV6SmpFekpqRXpKakV6SmpFekpqRXpKa0l4SmtNMEptWjFhbWw0TVRNbVFqUW1jM0J0Y0dReE15WXhNeVl4TXlZeE15WXhNeVl4TXlZeE15WXhNeVl4TXlZeE15WXhNeVl4TXlaQ01TWkRPQ1l4TXlaMWVXWjFMbTltWldWcWFTOHhNeVl4TXlZeE15WXhNeVl4TXlZeE15WXhNeVl4TXlaQ01TWkdOQ1ptYlhwMWRFUTBKakV6SmpFekpqRXpKakV6SmtJeEprWTBKbVp0ZFdwMVJ6TW1SRFFtWm01d1NVWTBKbVp0ZFdwMVJEUW1NVE1tTVRNbU1UTW1NVE1tUWpFbVJ6TW1LekV6Sm1aek1UTW1aV1ZpTVRNbVJUUW1SVFFtUlRRbVJUUW1SVFFtUlRRbVJEUW1NVE1tSzBjekpqRXpKakV6SmtZMEpqTXpKa1UwSmpFelkyczJSR054UjFoamIwTkdaWHRYU0dWemVtZHNkSHBtYVdkdWMydGxhVFF6SmtjekptWnpSek1tWldSSE15WjRjRzlzTG0xdFpuZ3ZSek1tYUhOd0wyWnRZbTl3YW50aWIzTm1kVzlxYjJadVlrY3pKa2N6SmtJMEpuUnhkWFZwUlRRbWJYTjJRelFtTXpNekprVTBKblZ2Wm5WdmNHUXhNeVl6TXlacGRHWnpaMlp6TXpNbVJUUW1kMnAyY21ZdWNYVjFhVEV6Sm1KMVptNUVOQ1l4TXlZeE15WXhNeVl4TXlaQ01TWkdOQ1l6TXlZNUxrZFZWak16SmtVMEpuVm1kSE5pYVdReE15WmlkV1p1UkRRbU1UTW1NVE1tTVRNbU1UTW1RakVtUmpRbVpXSm1hVVEwSmtJeEprWTBKbTF1ZFdsRU5DWkNNU1pHTkNadlluRjBSek1tUkRRbVpHczNhRnBXUkRRbWRIczFUVVUwSmt4WWJYZ3hUMUZuWkZoUVdYTjdOWGRIT1h0UlJUWW1RMDlHTkNZek15WjFlV1oxTG05bVpXVnFhVE16SmtVMEpuUjBZbTFrTVRNbWIySnhkRVEwSmtJeEpnPT0=	Get hash	malicious	HTMLPhisher	Browse	192.185.25.241
	http://crissertaoericardo.com.br/images/document.pif.rar	Get hash	malicious	GuLoader	Browse	192.185.217.125
	https://mpleho.com/wd/	Get hash	malicious	Phisher	Browse	69.49.234.173
	AWB_5771388044 Documente de expediere.exe	Get hash	malicious	FormBook	Browse	108.179.253.197
	Marsha Rowland Signature Required.pdf	Get hash	malicious	Unknown	Browse	192.185.35.240

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	ST07933.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.13.205
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	Ref_31020563.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Ref_31020563.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	xUPaeKk5wQ.msi	Get hash	malicious	AteraAgent	Browse	104.26.13.205
	7gBUqzSN3y.msi	Get hash	malicious	AteraAgent	Browse	104.26.13.205
	PO-8776-2024.js	Get hash	malicious	Remcos	Browse	104.26.13.205
	New Order Enquiry.js	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Bunker_STS_pdf.vbs	Get hash	malicious	Unknown	Browse	104.26.13.205
	Hesap_Hareketleri_10122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\newapp\newapp.exe	SecuriteInfo.com.Win32.Malware-gen.27656.20815.exe	Get hash	malicious	Blackshades, Quasar	Browse
	LisectAVT_2403002B_109.exe	Get hash	malicious	Blackshades	Browse
	LisectAVT_2403002B_486.exe	Get hash	malicious	RedLine	Browse
	CSXER09OOPMND--3098376TDGH.exe	Get hash	malicious	Nanocore	Browse
	PI and payment confirmed pdf.exe	Get hash	malicious	AgentTesla	Browse
	3SBlY301oa.exe	Get hash	malicious	XWorm	Browse
	z9order.exe	Get hash	malicious	AgentTesla	Browse
	Halkbank_Ekstre_20240626_0805893_4585894.xlxs.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-01.pdf.exe	Get hash	malicious	AgentTesla	Browse
	kSf9sIgyxl.exe	Get hash	malicious	Nanocore	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SPECIFICATIONS.e_ac7470a4318affd3ab562a594613aefb5d44f54_b596bc7b_7f693ab5-20cd-47d5-ba8e-d10ca3bd5ef5\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1142526433024709
Encrypted:	false
SSDEEP:	192:vkvOqTOc0UnUVaWB2WItazuiFbZ24lO8L:UOqTIUnUVam2SzuiFbY4lO8L
MD5:	E7C495A696D970B046C37AC54446B0D0
SHA1:	DBEB2516D504A0C3A9D626269902DFE9BD9E9242
SHA-256:	F8A6407DCB081D636C6694FED38608C412B303356C7ED6FF452FD09FDA972D0A
SHA-512:	936E111EACEBA228721B85CF3B51EAFC057C140F56417362B8BABB2267729EB914E476D54ECC98C586705A96E2A96A3A2CD9A6259BE3EC89C4E5F7F787B979C0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.3.1.8.1.4.2.1.5.4.5.9.4.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.3.1.8.1.4.2.8.4.2.1.2.0.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.f.6.9.3.a.b.5.-.2.0.c.d.-.4.7.d.5.-.b.a.8.e.-.d.1.0.c.a.3.b.d.5.e.f.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.2.9.0.0.a.2.b.-.b.d.b.8.-.4.c.7.9.-.b.5.d.4.-.2.9.5.3.3.6.5.d.6.1.f.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.S.P.E.C.I.F.I.C.A.T.I.O.N.S...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.a.t.e.k.P.o.r.o.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.5.4.-.0.0.0.1.-.0.0.1.4.-.c.1.8.7.-.b.2.3.b.1.8.4.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.4.e.6.1.b.e.1.7.c.0.b.8.7.5.b.8.b.9.a.3.b.7.9.5.1.1.f.a.e.7.d.0.0.0.0.0.0.0.0.!.0.0.0.0.8.4.4.a.4.6.5.a.0.9.b.f.e.6.e.a.4.d.7.5.f.6.d.f.a.d.9.f.3.1.8.5.3.8.a.e.1.8.9.1.!.S.P.E.C.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE724.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Tue Dec 10 15:29:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	441585
Entropy (8bit):	3.411909227449702
Encrypted:	false
SSDEEP:	3072:16G8eeG1AGZSV3/4RcSbNtFofoyHS/QoqtuXFy27U/I1CCqERAF88X3+vVhq:AGz1AGZyv0bNtFbGIUgqEC3Q3
MD5:	687AB5CB029E22FAB2565BF1EF821AB6
SHA1:	C400632934175538ED8E4E98C9C11832B11D6818
SHA-256:	BAB2EDE47BBD119DA0D0824CF75170A61804F9F7E84979A2E90730F07BEC728E
SHA-512:	B52187374724BE60112638ABD10E9DEC0467D658AF8BE1BFBC10224537340F5AACF1EA27BCA4594BF21DD3C41342EE76CF1F7E1D88D5D8C3597D121DF829472B
Malicious:	false
Preview:	MDMP..a..... .......>^Xg....................................$....!..........8!.......O..............l.......8...........T...........@/...............@...........B..............................................................................eJ......hC......Lw......................T.......T...;^Xg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE88C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8810
Entropy (8bit):	3.714534480184789
Encrypted:	false
SSDEEP:	192:R6l7wVeJpncM+T6YEIbLF5tsgmf+74Qprt89b5PkfPGTm:R6lXJyp6YEApsgmfS4P58fb
MD5:	3D2DA25795C84E9986100FAF9158B94F
SHA1:	C2E1C6D8138363DCFBF6CDD03B9ECD82FFA60385
SHA-256:	299DB734C263AA9B972D352AE2CE9D76C78D251AE9EF5CAA1DFA80EF218AC8BB
SHA-512:	BD5F0B645A8314ACF4702855834A9C03F46735D95D6EE0CE86C2BDA45DDC9EFC936CBF78CC48475A4ADE4C0F6FCE8DA66B12089D0C034E3C5A0A4F5FD7AB9C2A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8EB.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4778
Entropy (8bit):	4.554762685234558
Encrypted:	false
SSDEEP:	48:cvIwWl8zsFuJg771I9MoSWpW8VYlYm8M4JQ+FByyq85zgsTCCb3d:uIjfFkI7rW7VBJS5OCCb3d
MD5:	2AA49A38C6899EAF2ECEFC609DA0A8F2
SHA1:	A93DDFF2D72555E26C8D9116BACFE12F140C0971
SHA-256:	D3759533AAED556F2C411BADC0A7807A37136C1173BEA6A1580137AEAA5A7C02
SHA-512:	0BB77B8AF5E21DBCB572A5F95F811BAF38EEB921EE5FEF326CC17654D9FD18A479973FE8C6AAB2D2B35D935129BA405F53A7A041661DFFB09A8F87C7FFDBD87A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="625351" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newapp.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\newapp\newapp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Roaming\newapp\newapp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	47584
Entropy (8bit):	6.391877602293662
Encrypted:	false
SSDEEP:	768:DeSZaMT79n3DwU8ZCM2o1QG/n29WERqqJaqW/P8+4W:DeoaElzEZ2fG/nmkK4s+4W
MD5:	94C8E57A80DFCA2482DEDB87B93D4FD9
SHA1:	5729E6C7D2F5AB760F0093B9D44F8AC0F876A803
SHA-256:	39E87F0EDCDD15582CFEFDFAB1975AADD2C7CA1E3A5F07B1146CE3206F401BB5
SHA-512:	1798A3607B2B94732B52DE51D2748C86F9453343B6D8A417E98E65DDB38E9198CDCB2F45BF60823CB429B312466B28C5103C7588F2C4EF69FA27BFDB4F4C67DC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win32.Malware-gen.27656.20815.exe, Detection: malicious, Browse Filename: LisectAVT_2403002B_109.exe, Detection: malicious, Browse Filename: LisectAVT_2403002B_486.exe, Detection: malicious, Browse Filename: CSXER09OOPMND--3098376TDGH.exe, Detection: malicious, Browse Filename: PI and payment confirmed pdf.exe, Detection: malicious, Browse Filename: 3SBlY301oa.exe, Detection: malicious, Browse Filename: z9order.exe, Detection: malicious, Browse Filename: Halkbank_Ekstre_20240626_0805893_4585894.xlxs.exe, Detection: malicious, Browse Filename: hesaphareketi-01.pdf.exe, Detection: malicious, Browse Filename: kSf9sIgyxl.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.]..............0..n..........b.... ........@.. ..............................h.....`.....................................O....................x...A.......................................................... ............... ..H............text...hm... ...n.................. ..`.rsrc................p..............@..@.reloc...............v..............@..B................D.......H........D...8..........h}..p...........................................0...........(......}......}......}..... L...}......}......}......}.....s....}.....s....}.......s....}.......s....}.....s....}....r...p(......,...}.....r...p}.....0..........s......r...po.....r...po......(....o....s.....r...p..(...........( ...(!...o"...r!..po#...o$...t.......o.......#..rA..p..o%...(....(....(&.....................Tp.# .....(.....0............}......}......}......}......}......}.....s

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421678588395099
Encrypted:	false
SSDEEP:	6144:wSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNc0uhiTw:bvloTMW+EZMM6DFy203w
MD5:	563928E38B4ECA2F16051D1E886805A7
SHA1:	04DCB1935A7E1E7105DB0ABC0438141CDB41B7EF
SHA-256:	997B24299DC104775434DB2BBECB373765343A255CCAA8F9B26D7564514FD9AA
SHA-512:	91F15AC0D7118EDBA5B25186A2D514E65C9E89589E5206AA8590E6626F63E29389D36BEEF92B5DE00E92495B802FE79F648E1278AA15A55CCCB1DE845467895F
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..{=.K................................................................................................................................................................................................................................................................................................................................................l.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\newapp\newapp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	31
Entropy (8bit):	3.6034123432601906
Encrypted:	false
SSDEEP:	3:iLpVO38a33Pov:idm8836
MD5:	15A7C996F2983DBDB82E0968752EE52F
SHA1:	01F65B2274421164647D814ED141A523B4BE974A
SHA-256:	DD36366E8979CFE91E3180FB5809F71BA3984CC44BA0EF94A74EB4946C177A71
SHA-512:	E1DAE56F1653A5FCACEAC30B327EE8014E2E84232176A06A618888FF8C38C6BB348E80842269DEB773E0AD1F3806A0AAB660F68098083F5B582C7BD3B6337D4D
Malicious:	false
Preview:	*INTERNAL COMPILER ERROR*..

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.996954316248964
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	SPECIFICATIONS.exe
File size:	607'232 bytes
MD5:	f55f417cb656aeddb7e17504bbf28102
SHA1:	844a465a09bfe6ea4d75f6dfad9f318538ae1891
SHA256:	f9f3ab7e1e35b79ad0451c58423219c56e9222c60c54ef78e608de0796ca5347
SHA512:	eca7c26d31a7c6185b428ddc998340fdcfb5512b26d6b2cff2c27807c09eb457595f97903c4aa88bd4597c532c7583c57a80780bb3cbbe6a1c53395650405d24
SSDEEP:	12288:c0Yw1aUwjfFJY26YnQg4YDfoBp6SZHh52EFXIPMdjSCZ9t:PYWaUw5a26YnQgBov2EWkHjt
TLSH:	48D4235E22C962BBCA2F80F559B819E5426FB493EF37176D67341390980A0379FE24F1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...R.Pg.........."...0.d....&........... ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67508452 [Wed Dec 4 16:33:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x92568	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1a64	0x1c00	b02ca6e0d650e3c78c6cde180ca192bc	False	0.6061662946428571	data	5.808406449887315	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x92568	0x92600	2b0cd18deb61d495441b2977220fc020	False	0.9991910626601196	data	7.999540942974163	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
M4LWARE	0x4110	0x92018	data	1.0003193766303258
RT_VERSION	0x96128	0x254	data	0.45805369127516776
RT_MANIFEST	0x9637c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 16:29:02.689627886 CET	49704	443	192.168.2.5	104.26.13.205
Dec 10, 2024 16:29:02.689678907 CET	443	49704	104.26.13.205	192.168.2.5
Dec 10, 2024 16:29:02.689770937 CET	49704	443	192.168.2.5	104.26.13.205
Dec 10, 2024 16:29:02.696736097 CET	49704	443	192.168.2.5	104.26.13.205
Dec 10, 2024 16:29:02.696753025 CET	443	49704	104.26.13.205	192.168.2.5
Dec 10, 2024 16:29:03.941157103 CET	443	49704	104.26.13.205	192.168.2.5
Dec 10, 2024 16:29:03.941440105 CET	49704	443	192.168.2.5	104.26.13.205
Dec 10, 2024 16:29:03.945966959 CET	49704	443	192.168.2.5	104.26.13.205
Dec 10, 2024 16:29:03.945988894 CET	443	49704	104.26.13.205	192.168.2.5
Dec 10, 2024 16:29:03.946326017 CET	443	49704	104.26.13.205	192.168.2.5
Dec 10, 2024 16:29:03.991934061 CET	49704	443	192.168.2.5	104.26.13.205
Dec 10, 2024 16:29:03.996279955 CET	49704	443	192.168.2.5	104.26.13.205
Dec 10, 2024 16:29:04.043334007 CET	443	49704	104.26.13.205	192.168.2.5
Dec 10, 2024 16:29:04.390172005 CET	443	49704	104.26.13.205	192.168.2.5
Dec 10, 2024 16:29:04.390242100 CET	443	49704	104.26.13.205	192.168.2.5
Dec 10, 2024 16:29:04.390517950 CET	49704	443	192.168.2.5	104.26.13.205
Dec 10, 2024 16:29:04.408814907 CET	49704	443	192.168.2.5	104.26.13.205
Dec 10, 2024 16:29:06.639903069 CET	49707	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:06.759567022 CET	21	49707	192.254.225.136	192.168.2.5
Dec 10, 2024 16:29:06.761780024 CET	49707	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:06.765769005 CET	49707	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:06.797799110 CET	49708	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:06.889244080 CET	21	49707	192.254.225.136	192.168.2.5
Dec 10, 2024 16:29:06.889317036 CET	49707	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:06.917956114 CET	21	49708	192.254.225.136	192.168.2.5
Dec 10, 2024 16:29:06.918042898 CET	49708	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:06.924050093 CET	49708	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:06.925409079 CET	49709	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:07.043761969 CET	21	49708	192.254.225.136	192.168.2.5
Dec 10, 2024 16:29:07.044382095 CET	49708	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:07.045245886 CET	21	49709	192.254.225.136	192.168.2.5
Dec 10, 2024 16:29:07.045320988 CET	49709	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:07.045492887 CET	49709	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:07.046595097 CET	49710	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:07.165342093 CET	21	49709	192.254.225.136	192.168.2.5
Dec 10, 2024 16:29:07.166529894 CET	21	49710	192.254.225.136	192.168.2.5
Dec 10, 2024 16:29:07.166598082 CET	49709	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:07.166629076 CET	49710	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:07.166886091 CET	49710	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:29:07.286596060 CET	21	49710	192.254.225.136	192.168.2.5
Dec 10, 2024 16:29:07.286668062 CET	49710	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:30:36.474371910 CET	49897	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:30:36.593935013 CET	21	49897	192.254.225.136	192.168.2.5
Dec 10, 2024 16:30:36.594904900 CET	49897	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:30:36.598743916 CET	49897	21	192.168.2.5	192.254.225.136
Dec 10, 2024 16:30:36.718250036 CET	21	49897	192.254.225.136	192.168.2.5
Dec 10, 2024 16:30:36.718871117 CET	49897	21	192.168.2.5	192.254.225.136

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 16:29:02.544996023 CET	63980	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:29:02.682189941 CET	53	63980	1.1.1.1	192.168.2.5
Dec 10, 2024 16:29:05.740401030 CET	56891	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:29:06.636199951 CET	53	56891	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 16:29:02.544996023 CET	192.168.2.5	1.1.1.1	0x6623	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:29:05.740401030 CET	192.168.2.5	1.1.1.1	0xace0	Standard query (0)	ftp.ercolina-usa.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 16:29:02.682189941 CET	1.1.1.1	192.168.2.5	0x6623	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:29:02.682189941 CET	1.1.1.1	192.168.2.5	0x6623	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:29:02.682189941 CET	1.1.1.1	192.168.2.5	0x6623	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:29:06.636199951 CET	1.1.1.1	192.168.2.5	0xace0	No error (0)	ftp.ercolina-usa.com	ercolina-usa.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:29:06.636199951 CET	1.1.1.1	192.168.2.5	0xace0	No error (0)	ercolina-usa.com		192.254.225.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.26.13.205	443	528	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:03 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-10 15:29:04 UTC	424	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 15:29:04 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8efe44b15db5de98-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1960&min_rtt=1950&rtt_var=751&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1438423&cwnd=208&unsent_bytes=0&cid=96ba7dc152bfa4a0&ts=460&x=0"
2024-12-10 15:29:04 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

Target ID:	0
Start time:	10:28:59
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\SPECIFICATIONS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SPECIFICATIONS.exe"
Imagebase:	0x2bda53e0000
File size:	607'232 bytes
MD5 hash:	F55F417CB656AEDDB7E17504BBF28102
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2344463767.000002BDA75C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2345233326.000002BDB7261000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:28:59
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:29:00
Start date:	10/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:29:00
Start date:	10/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	10:29:00
Start date:	10/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:	0xb60000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4502632182.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.4501166919.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4501166919.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.4502632182.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4502632182.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:29:01
Start date:	10/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:	0x570000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:29:01
Start date:	10/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6484 -s 1216
Imagebase:	0x7ff67d3f0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:29:12
Start date:	10/12/2024
Path:	C:\Users\user\AppData\Roaming\newapp\newapp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\newapp\newapp.exe"
Imagebase:	0x880000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:29:12
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:29:21
Start date:	10/12/2024
Path:	C:\Users\user\AppData\Roaming\newapp\newapp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\newapp\newapp.exe"
Imagebase:	0x5c0000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:29:21
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848F1D44D Relevance: 2.8, Strings: 1, Instructions: 1566
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 00007FF848F1DFAC

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 98e3fd5b1d9f751528c3cf85006c1b1a2038e30c491e2f2ace6fbfccc8102654
Instruction ID: eb58c82a1e8fdc87edb3ac2903ab35637e4b83413875a1a8173adcbb944f2543
Opcode Fuzzy Hash: 98e3fd5b1d9f751528c3cf85006c1b1a2038e30c491e2f2ace6fbfccc8102654
Instruction Fuzzy Hash: 41B21030A1CB4A4FD359EB2884914B5B7E2FF95341F1446BEE48AC7296DF38E846C781

Function 00007FF848FF0000 Relevance: 2.3, Instructions: 2275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348487144.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848ff0000_SPECIFICATIONS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3253ec4c799dbdf8e30ba61c31ca6be205cbda4c701f10a6e19468831fda2f86
Instruction ID: ee4192df35b84c17356550de99c6c31ace14ae2851535d22cb54af7731c1783a
Opcode Fuzzy Hash: 3253ec4c799dbdf8e30ba61c31ca6be205cbda4c701f10a6e19468831fda2f86
Instruction Fuzzy Hash: 09E2297280DAC98FE756FB2888555A4BBE0FF96340F1801FBD689CB1D3DB286846C745

Function 00007FF848F12A2C Relevance: 1.7, Strings: 1, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fish, xrefs: 00007FF848F12A80

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID:
String ID: fish
API String ID: 0-1064584243
Opcode ID: dad33532f620180589153d136f04ab2016b76670bbb8032e7f3760bd901f9002
Instruction ID: f29e8f51705f6199d2c2b3fd8f7c39ab191924235aedf580df865ae98af2c75c
Opcode Fuzzy Hash: dad33532f620180589153d136f04ab2016b76670bbb8032e7f3760bd901f9002
Instruction Fuzzy Hash: 6FD12531A1CA4A4FE75DFBB898551B977E1EF96350F0441BED48BC32D2DE28AC028785

Function 00007FF848F22D79 Relevance: 1.4, Strings: 1, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

gfff, xrefs: 00007FF848F22DE0

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 0e1a7d5aecad90cbb516de6a9ffd2bc2c080e6f12be7663c1ca3401b3d7aaa73
Instruction ID: cf02706bfac181e3f8b945416cce0923ce039f67eda37c9039fe9bb51c4cdc5d
Opcode Fuzzy Hash: 0e1a7d5aecad90cbb516de6a9ffd2bc2c080e6f12be7663c1ca3401b3d7aaa73
Instruction Fuzzy Hash: 39514931B0D7950FD30E967C5C61061BBE1EB86311B0982BFD485CB2E7DA299C1AC345

Function 00007FF848F1F619 Relevance: 1.3, Instructions: 1295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3dd34ad2851130abaec0e6f9406baae1048b567d98c366363b7ca0d61aa2ac
Instruction ID: 26de6f5e4348f7b972119d6fa35bcefdcab64f4303c27dd0ae4169e99da77e93
Opcode Fuzzy Hash: 1a3dd34ad2851130abaec0e6f9406baae1048b567d98c366363b7ca0d61aa2ac
Instruction Fuzzy Hash: 9E92BF71A1DA4A8FEB98EB28D495AB877E1FF55340F1400B9D44EC72E2DF29AC41CB44

Function 00007FF848F16FB8 Relevance: .9, Instructions: 920COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13db77648799add7f5ad2e0d81859219f07cc887a2df91333a701bbe1d3a1861
Instruction ID: 93c72fc37c2e16d221929ad32d70b72813953e92c5f32b99743209b37a8916c2
Opcode Fuzzy Hash: 13db77648799add7f5ad2e0d81859219f07cc887a2df91333a701bbe1d3a1861
Instruction Fuzzy Hash: E1529630A1CA098FDB68EB28D455A7977E1FF55341F5401BDE48EC72D2DF24AC428B85

Function 00007FF848F1A4D0 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214b022484cb137503541da58709cd65f8218c6f787fc618ce9f82085256555a
Instruction ID: 7c5d3500d2bc931a5d20955049df0270684c5e770a1dfc5be2a0f97c8d855206
Opcode Fuzzy Hash: 214b022484cb137503541da58709cd65f8218c6f787fc618ce9f82085256555a
Instruction Fuzzy Hash: B5D1563191CB864FE31DDB2894951B1B7E2FF95311F1446BED4CAC32E5DB28A886C781

Function 00007FF848F23442 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e71a71b2923f211e7c02067a6d7e60dd751db3f685f67ffa16247ce5604854
Instruction ID: ac75afd7205dcff58ab21f9d3ce17494fd17481ecb854a2cb71a9e31071cdc70
Opcode Fuzzy Hash: c4e71a71b2923f211e7c02067a6d7e60dd751db3f685f67ffa16247ce5604854
Instruction Fuzzy Hash: 25415B3150D78A0FD71E9A3898261B57BA5EB83320B1582BFD087CB1E7DD196C4783D6

Function 00007FF848F2348F Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468b2bfd362fade68c0c7bf767ce34d7b0b555dc84403cf87547ae3d4b3b0ac6
Instruction ID: bed1ba59c79744be906b48a4636c7a06d435dbe874ae160d17283709a122762d
Opcode Fuzzy Hash: 468b2bfd362fade68c0c7bf767ce34d7b0b555dc84403cf87547ae3d4b3b0ac6
Instruction Fuzzy Hash: A7412831A0D78A0FD71E9B7888251757FA5EB93310B1582BFD086CB1E7DD28AC0687D2

Function 00007FF848F11A22 Relevance: 1.6, APIs: 1, Instructions: 144
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF848F11B02

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 77a75dd531220a48dc08e64ef0e4d484c77ceaef004eaa2dc98e014fe51ddca4
Instruction ID: f7ade116b405b394e51b0472c28b24615a58fb99153bcb2787d6a9e682bcb82e
Opcode Fuzzy Hash: 77a75dd531220a48dc08e64ef0e4d484c77ceaef004eaa2dc98e014fe51ddca4
Instruction Fuzzy Hash: E741F63090CB888FDB19DBA898466F97FE1EF56321F0442AFD049D3293CF64A856C795

Function 00007FF848F18025 Relevance: 1.6, APIs: 1, Instructions: 125
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF848F26BF1

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 29ff5bea6dd3d25d57dc4543cd92e7f22af0bacf8f0380bcc39b6b241d434c76
Instruction ID: c9af608ddf07eccaf69a10cb0fc5b92a98ebcae35003b4294211bb5a8387f78b
Opcode Fuzzy Hash: 29ff5bea6dd3d25d57dc4543cd92e7f22af0bacf8f0380bcc39b6b241d434c76
Instruction Fuzzy Hash: 40310531A0CA5C4FDB18EB5DD8496F97BE1FB95721F00023FD04AC3292CB246846C795

Function 00007FF848F10C61 Relevance: 1.6, APIs: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FF848F10D1F

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 23cf7d88da68bb02cd81f0e375850415be1bb854cac2b600901b05d549d693d0
Instruction ID: 379461a5e008985814de30db3725fb5355a1227c2341786de0c6e9afff037a1b
Opcode Fuzzy Hash: 23cf7d88da68bb02cd81f0e375850415be1bb854cac2b600901b05d549d693d0
Instruction Fuzzy Hash: EE31147040D7889FDB16EB688855AFA7FF4EF52321F0441AFE089C3192DB24684ACB52

Function 00007FF848F1051A Relevance: 1.6, APIs: 1, Instructions: 112
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF848F11B02

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b73abc2d3fe9eaf79d5a7a5bcb98c739e38cadd1b5348c9ce6fbe1e76637e919
Instruction ID: 0bb943bddb2e937dd1ff44e9fbcfdb51b143af8eed8ae19b2ff02f9fd7c3d6be
Opcode Fuzzy Hash: b73abc2d3fe9eaf79d5a7a5bcb98c739e38cadd1b5348c9ce6fbe1e76637e919
Instruction Fuzzy Hash: FA31D630A0CA0C8FDB18DF5CD8496F977E1FB99311F00422FD04AD3292CB70A8468B95

Function 00007FF848F104DA Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FF848F10D1F

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: dd2e4413080814936e3e803a519a188bf654c03e66cd719b50677f71b81c24b1
Instruction ID: 3e7a55df0e9cdd44390ecb9c668c6a420bd910339d329720ac3a57ce71144490
Opcode Fuzzy Hash: dd2e4413080814936e3e803a519a188bf654c03e66cd719b50677f71b81c24b1
Instruction Fuzzy Hash: 9821717090CA1C9FDB28EF59D849BFAB7E0EB55321F00422ED04AD3552DB74A845CB55

Function 00007FF848F104EA Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FF848F10D1F

Memory Dump Source

Source File: 00000000.00000002.2348151131.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_SPECIFICATIONS.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: dd2e4413080814936e3e803a519a188bf654c03e66cd719b50677f71b81c24b1
Instruction ID: 3e7a55df0e9cdd44390ecb9c668c6a420bd910339d329720ac3a57ce71144490
Opcode Fuzzy Hash: dd2e4413080814936e3e803a519a188bf654c03e66cd719b50677f71b81c24b1
Instruction Fuzzy Hash: 9821717090CA1C9FDB28EF59D849BFAB7E0EB55321F00422ED04AD3552DB74A845CB55

Function 00007FF848FF10C9 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348487144.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848ff0000_SPECIFICATIONS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fdb91678f55757374c05df3011b97b26b15b7ba7bc6dc85bacad87df70d1553
Instruction ID: fb3efda7c4005a778405afc7c614c154873bb1dda6d5f73f2179d396aa209ecb
Opcode Fuzzy Hash: 9fdb91678f55757374c05df3011b97b26b15b7ba7bc6dc85bacad87df70d1553
Instruction Fuzzy Hash: 4171463190CA894FEB57EB2898595B57BE1EF56340F0901FBD04AC72D3EF29A885C385

Analysis Process: jsc.exePID: 528, Parent PID: 6484COMMON

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	203
Total number of Limit Nodes:	21

Executed Functions

Function 06A13568 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A13C67
$]q, xrefs: 06A13CC0
$]q, xrefs: 06A13C73
$]q, xrefs: 06A13C9C
$]q, xrefs: 06A13CB4
$]q, xrefs: 06A13C90

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 42ec6fcbde521e689a1508c312a9af4bb693036716c3a4f22b0ca78543f18fc4
Instruction ID: 73e8b981165f524330b5614a5df37cc4d20e877359b4d0e9a46e6e20b570b930
Opcode Fuzzy Hash: 42ec6fcbde521e689a1508c312a9af4bb693036716c3a4f22b0ca78543f18fc4
Instruction Fuzzy Hash: CE323031E1061A8FCB54EF75D89459DF7B6FFC9300F11C6AAD409AB254EB30A985CB90

Function 06A17E60 Relevance: 3.0, Strings: 2, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A181CF
$]q, xrefs: 06A181C3

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: c003de25d5e1fe4a2d51f826a1077040193c45cefdc4a7b3d95a06fe5260dda2
Instruction ID: ed4bf8b435ca5bf8d1275ef1127fbafcf18d13687dfc8492a2d2f7051bb9dcce
Opcode Fuzzy Hash: c003de25d5e1fe4a2d51f826a1077040193c45cefdc4a7b3d95a06fe5260dda2
Instruction Fuzzy Hash: 0A029C30B0021A8FDB54EB64D990AAEB7F6FF84304F148529D416AF394DB39ED46CB91

Function 06A12728 Relevance: 1.1, Instructions: 1072COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c03c444681108b6267d09c69fae3deadc2e975083fa7c6b83d205234795531
Instruction ID: 0cd930f91cc59f3a75c84b38e729bb027076a3b4d6f3005d5e85b87378202e83
Opcode Fuzzy Hash: 69c03c444681108b6267d09c69fae3deadc2e975083fa7c6b83d205234795531
Instruction Fuzzy Hash: 6BA22234A002088FDBA4EF68C584B9DBBF2EB49314F5584A9D409AF365DB35ED85CF90

Function 06A166D8 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5910ad0c97e4e52339014e88e2b00d1406306fface2ecf24baeba8118c7b511a
Instruction ID: bc8654084bb107b2fad3d15887c222f872bde2a3891b78edc74c0b0107769e53
Opcode Fuzzy Hash: 5910ad0c97e4e52339014e88e2b00d1406306fface2ecf24baeba8118c7b511a
Instruction Fuzzy Hash: 6E628A34A002148FDB64EF68D594AADB7F2EF88314F149469E40ADF3A4DB35EC46CB90

Function 06A1C260 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ba59803dc4d435bbc7f6c4460d774af1b10ef075555395215c635da1774349
Instruction ID: 718a1a38c6a5ede0c2a849382c083dac0c9f29cc4d5cd73b2dfe28fba7865bac
Opcode Fuzzy Hash: 74ba59803dc4d435bbc7f6c4460d774af1b10ef075555395215c635da1774349
Instruction Fuzzy Hash: AD329F30B402198FDF55EF68E590BAEB7B6EB88320F108525E506DB355DB38EC46CB91

Function 06A156A8 Relevance: .6, Instructions: 602COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f430299d40732d0ba3b3317c70ac34f18aece6acb3b5f4a55987a28599dadd
Instruction ID: 14e84b64e4a3b587f106a5540b5bfb05fde9e133ae5fe67c9a64203b273e65a9
Opcode Fuzzy Hash: 88f430299d40732d0ba3b3317c70ac34f18aece6acb3b5f4a55987a28599dadd
Instruction Fuzzy Hash: 8722F4B5F002158FDB60EFA4D8906AEB7B2EBC5320F14882AD9599F354DB34DC42CB91

Function 06A1B2FF Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa05ed61e66512931233bad4a7efe95b289232cb10816d1f8e60e9b8a60a2f7
Instruction ID: 977f64fc93c1c9bb37418b2cc669673871df999a1b5ca2270dcba1db374d10c6
Opcode Fuzzy Hash: dfa05ed61e66512931233bad4a7efe95b289232cb10816d1f8e60e9b8a60a2f7
Instruction Fuzzy Hash: 0E224170E102098FDF64EF69D5907AEB7B6EB49310F248926E415DF395CA34DC82CBA1

Function 06A1ADA8 Relevance: 10.4, Strings: 8, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A1AF80
$]q, xrefs: 06A1AF74
$]q, xrefs: 06A1AF1C
$]q, xrefs: 06A1AF57
$]q, xrefs: 06A1AED5
$]q, xrefs: 06A1AF28
$]q, xrefs: 06A1AEC9
$]q, xrefs: 06A1AF4B

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 88bae86d03fb66ffe31739bb3053e1c8a3454073eaaf3517724171c5ede73a86
Instruction ID: 2efef9e72050fc050857227f169c923ff5611d9c0299325a8dfe7076c80579fa
Opcode Fuzzy Hash: 88bae86d03fb66ffe31739bb3053e1c8a3454073eaaf3517724171c5ede73a86
Instruction Fuzzy Hash: 04E18B30E012198FCB69EF69D5906AEB7B6EF89300F208529E519EF354DB34DC46CB91

Function 06A1B728 Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A1BCE1
$]q, xrefs: 06A1BCED
$]q, xrefs: 06A1BC85
$]q, xrefs: 06A1BCAD
$]q, xrefs: 06A1BCB9
$]q, xrefs: 06A1BC79

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 2a0f953b190c20d4cf30e69c2e81f2900cac2f7dd1a989de3adc730058f28119
Instruction ID: 7f53587915683a997bcce0221bdfc852f5c6d5c861be9cecef51d72a3bfacdbe
Opcode Fuzzy Hash: 2a0f953b190c20d4cf30e69c2e81f2900cac2f7dd1a989de3adc730058f28119
Instruction Fuzzy Hash: C3026C30E0021A8FDBA4EF68D590AADB7B6FF45300F14896AD405DF255DB34ED46CBA1

Function 06A0A0D1 Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06A0A15E
GetCurrentThread.KERNEL32 ref: 06A0A19B
GetCurrentProcess.KERNEL32 ref: 06A0A1D8
GetCurrentThreadId.KERNEL32 ref: 06A0A231

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7e6d1080c32daac3d1d841f4d2f7d10484b54c76e1fb7100e11e35be627b5663
Instruction ID: 0ceb8d53325f3772ce46c8c28662acc7284e3633b0062f209c8d5ba63848a08e
Opcode Fuzzy Hash: 7e6d1080c32daac3d1d841f4d2f7d10484b54c76e1fb7100e11e35be627b5663
Instruction Fuzzy Hash: 375187B09003499FDB54DFAAD948B9EBFF1FF49304F208459E109A72A1D7345884CB61

Function 06A0A0E0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06A0A15E
GetCurrentThread.KERNEL32 ref: 06A0A19B
GetCurrentProcess.KERNEL32 ref: 06A0A1D8
GetCurrentThreadId.KERNEL32 ref: 06A0A231

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8136ae8644cc4489952811a7bf84e6a37439ff5b53ba01bb69070d9a6de77aae
Instruction ID: c776244cace03bea6a588dbd37a12f2ccb4c856444c5543437a7411e927c20e4
Opcode Fuzzy Hash: 8136ae8644cc4489952811a7bf84e6a37439ff5b53ba01bb69070d9a6de77aae
Instruction Fuzzy Hash: 7E5177B09003099FDB54DFAAD948BAEBBF1FF49304F208459E509A73A0D7349944CF65

Function 06A19230 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A192B2
$]q, xrefs: 06A19277
$]q, xrefs: 06A192BE
$]q, xrefs: 06A19283

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 8cf2e9b336acf2261e97aee045f1a2b0421610f5634497f089ca4389f851d5af
Instruction ID: 15a2f0059594908615a23508403537da655c50630b1c67ce67f793c77020d901
Opcode Fuzzy Hash: 8cf2e9b336acf2261e97aee045f1a2b0421610f5634497f089ca4389f851d5af
Instruction Fuzzy Hash: 08914130B0021A9FDB94EF65D8607AFB7F6BF85204F108569D819EF344EA709D46CB92

Function 06A1D030 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A1D42F
$]q, xrefs: 06A1D43B
$]q, xrefs: 06A1D427

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: d0e799437d38e07bf30e5575f3ad251051eb6eb19f49275c9ec30f6995ce867b
Instruction ID: 9806eb9a77da6b0228f47943e888e2c786a4ec3d1ff4bcf9160a40c5ab6f0665
Opcode Fuzzy Hash: d0e799437d38e07bf30e5575f3ad251051eb6eb19f49275c9ec30f6995ce867b
Instruction Fuzzy Hash: 4062613060061A8FCB55EF69E580A5EB7B6FF85304B208A69D005DF369EB75EC46CB90

Function 06A14C70 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 06A14DC1
fbq, xrefs: 06A14C9B
\Obq, xrefs: 06A14E4B

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 86a8382e60f39b7969432b512510449be4d98bb598e6efe3475ed8aa959bb431
Instruction ID: 86b4f3a509861c8f96a654859a6c78acb3537f3b2f4f73c12fbc900ae13c8252
Opcode Fuzzy Hash: 86a8382e60f39b7969432b512510449be4d98bb598e6efe3475ed8aa959bb431
Instruction Fuzzy Hash: B0618070E002199FEB54EFA9C4547AEBBF6FF88700F20842AD106AF394DB758D458B91

Function 06A19220 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A192B2
$]q, xrefs: 06A19277

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 754a057924187798005eac2e077e560efd12dc2a0d03d8a799bcedb42dec35ed
Instruction ID: c172ebd8c901d5ce8f6c36dbb62d26c9ad760250d89bcf31c724e951ed0fe525
Opcode Fuzzy Hash: 754a057924187798005eac2e077e560efd12dc2a0d03d8a799bcedb42dec35ed
Instruction Fuzzy Hash: 4E515430B001159FDB95EB75D860BAF77F6BB84604F108569D419EB354EA309C06CB92

Function 06A14C61 Relevance: 2.6, Strings: 2, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 06A14DC1
fbq, xrefs: 06A14C9B

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 8745d2ba0c33a7e007474b29a1efc39b2cdf8b3e17a5da01f632660d19f41593
Instruction ID: bbf8ec2e43b86a643015f622f37d4978f2fee901103ee5929bae94cf2f5c105a
Opcode Fuzzy Hash: 8745d2ba0c33a7e007474b29a1efc39b2cdf8b3e17a5da01f632660d19f41593
Instruction Fuzzy Hash: 78518270F002199FDB54DFA5C854BAEBBF6FF88710F20852AE106AF395DA758C018B91

Function 02D9EFB8 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4502549324.0000000002D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2d90000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac0d16b57877d44cdf14f08a621f7baaf98973512e74a22000d4d5096e881af
Instruction ID: a39758e77dffa354958652d9c01d855cc5c8cad453515ade9fdf743b3b6c0b9b
Opcode Fuzzy Hash: 7ac0d16b57877d44cdf14f08a621f7baaf98973512e74a22000d4d5096e881af
Instruction Fuzzy Hash: D041EF71E043558FCB14DFA9D8047AEBBF1EF89310F15866AD418A7741DB789885CBE0

Function 06A0672C Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06A0684A

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 21b5ecbee71e5a8446b618b0030f5d4fc862630322df2e33d6f4f93c15e22d58
Instruction ID: 3b61d12fd8e9e9b106f7e2b17bf8e255ecd1c0f1dd2440c52861e71ee896d4dd
Opcode Fuzzy Hash: 21b5ecbee71e5a8446b618b0030f5d4fc862630322df2e33d6f4f93c15e22d58
Instruction Fuzzy Hash: 5B51D0B0C00309AFDB14DF99D884ADEBBB5FF48314F24812AE818AB250D774A885CF90

Function 06A06738 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06A0684A

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 10d0f35a6dcdb653deafa3ec68b0987af35bc75740365c6739720426604eb390
Instruction ID: b1ba92b94df0443c1442ff6e25ece6a836455bae3cf7c8181ad1f9d14b4f814c
Opcode Fuzzy Hash: 10d0f35a6dcdb653deafa3ec68b0987af35bc75740365c6739720426604eb390
Instruction Fuzzy Hash: 6141C0B1D00309EFDB14DF9AD884ADEBBB5BF49314F24812AE818AB250D775A855CF90

Function 06A0A0B4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06A0B679

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ef8f8dd9180cc258162d1ce4ee6ede297446ebb7d029beb167578ab163ef224c
Instruction ID: 0c89e9ce9562801593b1e63367a67a28915b1b77548b4de6039d1b99881af662
Opcode Fuzzy Hash: ef8f8dd9180cc258162d1ce4ee6ede297446ebb7d029beb167578ab163ef224c
Instruction Fuzzy Hash: 784169B4900304CFDB44DF89C988AAABBF9FF88314F248498D519AB361D335A840CFA0

Function 06A0BF06 Relevance: 1.6, APIs: 1, Instructions: 73comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06A0BF90

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: e8bd928a2503b1ba85a44ad7f4c284b269e580a845f2e56a23d2ef52dc197bc1
Instruction ID: 23b54e30dca3a225a296354c9387a87ef0aecf082a8d0c71428a0e7000e189c2
Opcode Fuzzy Hash: e8bd928a2503b1ba85a44ad7f4c284b269e580a845f2e56a23d2ef52dc197bc1
Instruction Fuzzy Hash: 843112B0D01208EFEB54DF99D984BCEBBF5AF48314F208019E005AB390D775A945CFA5

Function 06A0BF08 Relevance: 1.6, APIs: 1, Instructions: 71comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06A0BF90

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: eaeca54a50eee4826bef2d108a5f63711874d6da77837d2f6415cf81592ccd1a
Instruction ID: 3e2d2e9023f3c06ef903060549bb77c3d18000176e0ee115838fa3a2f74ba96b
Opcode Fuzzy Hash: eaeca54a50eee4826bef2d108a5f63711874d6da77837d2f6415cf81592ccd1a
Instruction Fuzzy Hash: 1C3112B0D01208EFEB54DF99D984B8DBBF5AF48314F208019E005AB390D775A945CFA5

Function 06A0BD60 Relevance: 1.6, APIs: 1, Instructions: 71comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06A0BE15

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 27c31418143bcec58392909ec0282c3833bdb07b50d6269f5e793f9a3b3eec79
Instruction ID: ab0286c30ce5ff817ae46f7e2af3e424c02c91acafaa194f3f246d286e246f65
Opcode Fuzzy Hash: 27c31418143bcec58392909ec0282c3833bdb07b50d6269f5e793f9a3b3eec79
Instruction Fuzzy Hash: 52219D718003448FDB60EFA9E645BDBBFF4EF49314F14485AE449A7250C37AA588CBA1

Function 06A0A320 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06A0A3AF

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2baefebe79c93c4d02d4e16681f2edb44186608584a47280a29467e22cab849b
Instruction ID: e896101ac6cf3d6a42d44dcba339cad37d07c8f1e33e22e282f93065fb4b806c
Opcode Fuzzy Hash: 2baefebe79c93c4d02d4e16681f2edb44186608584a47280a29467e22cab849b
Instruction Fuzzy Hash: 2921D6B59003489FDB10DF9AD984ADEBFF9EB48310F14801AE954A7251D374A945CFA1

Function 06A0A328 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06A0A3AF

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ec8782990ea6d04750121f7ab41308bef86ecfcf0ab6913d79ae365702f6d97d
Instruction ID: 723c5a4ea8422390c74aa0b18939b8e6a213bfd6b1eea2447f3abf231f57936f
Opcode Fuzzy Hash: ec8782990ea6d04750121f7ab41308bef86ecfcf0ab6913d79ae365702f6d97d
Instruction Fuzzy Hash: DC21E4B59003089FDB10CF9AD984ADEFBF9FB48310F14801AE918A3350D378A944CFA1

Function 06A0DCCB Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06A0DD4B

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: bf62b175b2ddd61707a8332b803065f991f04ab6658aaf1c4dc16f99c0911be8
Instruction ID: 4f9e5cb8f65231387667db33702524db7fa1c065fea94f3ceaa5105b81d81f2f
Opcode Fuzzy Hash: bf62b175b2ddd61707a8332b803065f991f04ab6658aaf1c4dc16f99c0911be8
Instruction Fuzzy Hash: AF2104B59002099FDB54DF99D844BEEBBF5AF89310F10842AE458A7250C774A945CFA1

Function 02D98038 Relevance: 1.6, APIs: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 02D980B0

Memory Dump Source

Source File: 00000005.00000002.4502549324.0000000002D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2d90000_jsc.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 43a0584e7cb3709f93195ba14a36c4178fcc0f5de97b62ff6623246fcd222edd
Instruction ID: 0ac35aed568cfcfba78c0da8bbb0a5930e91116c60a3f9f938b40dcea29fb76b
Opcode Fuzzy Hash: 43a0584e7cb3709f93195ba14a36c4178fcc0f5de97b62ff6623246fcd222edd
Instruction Fuzzy Hash: 242113B1C0061A9BCB24DF9AC544B9EFBB4FB49720F14812AE858A7340D778A944CFA1

Function 06A0DCD0 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06A0DD4B

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: a9a67c2c3a8686d1df0405f6552dc2aabfe825fc0270b3910383f3b4cd1f4de8
Instruction ID: 7f5f88d37e5aed5c5c778c8ead2b574f178cf5607406cab45484e6c5690ca414
Opcode Fuzzy Hash: a9a67c2c3a8686d1df0405f6552dc2aabfe825fc0270b3910383f3b4cd1f4de8
Instruction Fuzzy Hash: F72102B59002099FDB54DF9AD844BEEBBF5AF89310F10842AE458A7290C778A945CFA1

Function 02D98040 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 02D980B0

Memory Dump Source

Source File: 00000005.00000002.4502549324.0000000002D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2d90000_jsc.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: be4f73fc86e249639f8981de4206160dc6fbb52c45b27575c69123bd39096fca
Instruction ID: 39464933e4c0fdd52acb0ff6a99e25ce670c410a1aa3a39d5d926aabb7aa0d90
Opcode Fuzzy Hash: be4f73fc86e249639f8981de4206160dc6fbb52c45b27575c69123bd39096fca
Instruction Fuzzy Hash: 8C1124B1C006199BCB24DF9AC544B9EFBB4BF49720F10812AD858A7340D778A944CFA1

Function 02D9F0A0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?), ref: 02D9F107

Memory Dump Source

Source File: 00000005.00000002.4502549324.0000000002D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2d90000_jsc.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a4b0849b19ba8f57810b4b7a160cec07fb7b83269c2d8434634c10e1dfbe99dc
Instruction ID: f95423082e82a51bd3be0d8859fa66f8e58c31a50f8b194cd795e7dd87f29a07
Opcode Fuzzy Hash: a4b0849b19ba8f57810b4b7a160cec07fb7b83269c2d8434634c10e1dfbe99dc
Instruction Fuzzy Hash: BB11DDB1C006599BCB10DFAAD544B9EFBB4AF48324F14816AE818B7240D778A945CFE5

Function 06A05688 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06A056F6

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 714599bab08f70527a27626d66d40cfb5ac1436a0c80babbfbdf2bcce52f41af
Instruction ID: 26bbfad267fda3e18347859e1a2777d673728e5117854bb1a5e9102cf6c94c5f
Opcode Fuzzy Hash: 714599bab08f70527a27626d66d40cfb5ac1436a0c80babbfbdf2bcce52f41af
Instruction Fuzzy Hash: 621102B5C002498FDB20DF9AD944BDEFBF9EB49320F14855AD819B7240C379A545CFA1

Function 06A04648 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06A056F6

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6d586562750640b7f0ff41a23b84db64b3de408d69150dac6309b79dbc54c37f
Instruction ID: a6dc6facc16cb03017cfcf8534a93c84e12764b9f1f33f76668c97b1a1720c56
Opcode Fuzzy Hash: 6d586562750640b7f0ff41a23b84db64b3de408d69150dac6309b79dbc54c37f
Instruction Fuzzy Hash: D211F0B5C003498FDB10DF9AD548B9EFBF8EB89320F14845AD919B7240C379A545CFA5

Function 06A0BDB9 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06A0BE15

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c687b22adf2219da80cba142b60d5b8baeaf982973481562d7f96e7a6bb99a03
Instruction ID: c4b45d0458e2b7d56f3fafccb6f64fc0b96b0b1c852470e6f570d3ea64d3abd4
Opcode Fuzzy Hash: c687b22adf2219da80cba142b60d5b8baeaf982973481562d7f96e7a6bb99a03
Instruction Fuzzy Hash: 1C1148B4800348CFCB20DF9AD544BDEBBF8EB49324F108459D558A7200C339A944CFA1

Function 06A0B8F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,06A0B8CD), ref: 06A0B957

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a0b71dc136e8644b329a9ada027278c6d828bd50a1d33a308ae85129734edf06
Instruction ID: 69c8e2a5f469f2a155ada86f27e6da30e9134b7097333645173768fec72bbf36
Opcode Fuzzy Hash: a0b71dc136e8644b329a9ada027278c6d828bd50a1d33a308ae85129734edf06
Instruction Fuzzy Hash: F31103B5800249CFDB20DF9AD944BDEBBF8EB49324F20841AD568B7250C779A944CFA5

Function 06A0AF64 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,06A0B8CD), ref: 06A0B957

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a7e865532682a0807601f6b56ec9810f7bcfcc60f9066c8acfab24fcdd094430
Instruction ID: 7957292929cb68b1d2d5dc57d0bc99bd82417fbc5d3a699caeee0f87ccf9c254
Opcode Fuzzy Hash: a7e865532682a0807601f6b56ec9810f7bcfcc60f9066c8acfab24fcdd094430
Instruction Fuzzy Hash: 061133B0800349CFDB60DF9AD544B9EBBF8EF48320F20845AD529B7250C379A944CFA4

Function 06A0B19C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06A0BE15

Memory Dump Source

Source File: 00000005.00000002.4507633419.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a00000_jsc.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 085c2d5bb432fe56c2fad5a82eae5d0a9676c27a6d8f106cf5c23debd95a93fa
Instruction ID: 4f17203f5da82e9406cab5649ac6deb48b72e4e23c8c6679d26003d56d3e0c8a
Opcode Fuzzy Hash: 085c2d5bb432fe56c2fad5a82eae5d0a9676c27a6d8f106cf5c23debd95a93fa
Instruction Fuzzy Hash: 3E1112B5800349CFDB20EF9AD548B9EFBF8EB49324F20845AD518B7250D379A944CFA5

Function 06A1DBA5 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06A1DD01

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 5d75187a27ae2d281ca42954ea3deae2b36c0cdf02ade30792f7c01c7d00f104
Instruction ID: c497c04b422016f4f4765f3a53c07d38d4cfbd77592e62b4c3f77b8b871b338a
Opcode Fuzzy Hash: 5d75187a27ae2d281ca42954ea3deae2b36c0cdf02ade30792f7c01c7d00f104
Instruction Fuzzy Hash: 75419D70E0020ADFDB65AF75D59069EBBB2BF85700F104929D405EF254EBB1E946CB81

Function 06A121D8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06A12313

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 54b19282fe63c63a6b93304311df3a92ddf77414bfc6f6274f4aab28211c5a34
Instruction ID: 14b09a878160a786595354235fb6ec7c84e519221e1450a78524627c2ec89cc0
Opcode Fuzzy Hash: 54b19282fe63c63a6b93304311df3a92ddf77414bfc6f6274f4aab28211c5a34
Instruction Fuzzy Hash: 1531F030B002058FDB59AB74E46076E7AE6BF89600F204578D406DF399EE35DD46CBA1

Function 06A14B59 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Obq, xrefs: 06A14B65

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: \Obq
API String ID: 0-2878401908
Opcode ID: 91df74a9f7f5d900dab786a2ef1ed79bbaddc7f0228056aeb1413fd8fcca5bb2
Instruction ID: ce75462a77a6f064cfabdfb7b50f2005e3f9cc254059aa160f86224a28a9db19
Opcode Fuzzy Hash: 91df74a9f7f5d900dab786a2ef1ed79bbaddc7f0228056aeb1413fd8fcca5bb2
Instruction Fuzzy Hash: 65F0FE70A54129DFDB14DF94E898BAEBBB2FF88701F204119E402AB294CBB01C01CF80

Function 06A162D8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a55b391d0c5556b2f0384c96cbbf1953218939c000de6ab5685b0fd991268c5
Instruction ID: 82069e263dd9ad2dc1234ccb93caa294efeb3601fb3e2baf45663bdc165004d6
Opcode Fuzzy Hash: 8a55b391d0c5556b2f0384c96cbbf1953218939c000de6ab5685b0fd991268c5
Instruction Fuzzy Hash: 6C618F71F001214FDB64AB6AC88066FBADBAFD4224B254479D80EDB364DE69ED0287D1

Function 06A143A0 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013f3cf19c3420b1ba65019164d7d6d20de22810bb35980975ffd1685eca6d77
Instruction ID: 0c8b93d7e014b30a75ba639f633b7924b7474b61dac3958e9165958ba26bef3c
Opcode Fuzzy Hash: 013f3cf19c3420b1ba65019164d7d6d20de22810bb35980975ffd1685eca6d77
Instruction Fuzzy Hash: 7A815D30B0060A8FDB54EFA9D45069EB7F2EB88304F108529D40ADF398EB34DC468B91

Function 06A146C0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01634b41ff82e4c583b9ae8926b7834d8b3204ff4de6b70a4dbaaab60b4ce77
Instruction ID: 1754faad149dbd4290cb0f321475c1fb8ba25119b8614bd239d9a2347518f2c7
Opcode Fuzzy Hash: c01634b41ff82e4c583b9ae8926b7834d8b3204ff4de6b70a4dbaaab60b4ce77
Instruction Fuzzy Hash: 8B914D30E1021A8FDF60DF68C890B9DB7B1FF89300F20859AD54DAB255DB74AA85CF91

Function 06A146D8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31a7a6f4a0f060c716df41457e26f8c42e246f3a1533475c201d4d7903a2a27
Instruction ID: 9e865f9c1bce13cab4975c14633897135547aa915b7c3e3e789e413078d4aeba
Opcode Fuzzy Hash: c31a7a6f4a0f060c716df41457e26f8c42e246f3a1533475c201d4d7903a2a27
Instruction Fuzzy Hash: C3913C34E1021A8BDF60DF68C890B9DB7B1FF89304F208599D54DAB255DB70AA85CF91

Function 06A1F008 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aabff80ca901698109c9508ecba0b080324cf2be87608db2b26ccd19fd0ae917
Instruction ID: 4bb4bf0b1ba75a7004c28fcd1111ea5e22f4ba48f6063e62f2952c0ceaf3437e
Opcode Fuzzy Hash: aabff80ca901698109c9508ecba0b080324cf2be87608db2b26ccd19fd0ae917
Instruction Fuzzy Hash: DC713C74A002499FDB54EFA9D990A9DBBF6FF88300F158569D409EB364EB30EC46CB50

Function 06A1F018 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcd1129e5c8c2a17179e62f04a55468da7e63e00d6ab634033588beb5ae543ef
Instruction ID: 7e2d469c2f748111de9b9a811f82ff193fe8b2d7372bf10fcdf09e6a90242c4e
Opcode Fuzzy Hash: bcd1129e5c8c2a17179e62f04a55468da7e63e00d6ab634033588beb5ae543ef
Instruction Fuzzy Hash: 66713B74A002499FDB54EFA9D990A9EBBF6FF88300F148569D409EB364DB30EC46CB50

Function 06A1FC98 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 122bd9d2efe8f3af62b161814c790e0067480d3e352bcf15aa0970da1199100d
Instruction ID: 4912e8303530dc08d2017a2d4345e7b06b4fe24482a0c35876c0c98ea3d63d7e
Opcode Fuzzy Hash: 122bd9d2efe8f3af62b161814c790e0067480d3e352bcf15aa0970da1199100d
Instruction Fuzzy Hash: 1D51F071E00155DFCB64BBB8E4842AEBBF2FF89315F108829E50ADF295DB318945CB81

Function 06A1FA48 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 122e0262c911d044cd346cb8dc6bc87f68950fa70168cc56b92e0639e1e06e69
Instruction ID: 9735ae6c629421b5ab6df14e383f84b743cf97c668f4b7529b5559a0e80cbf1d
Opcode Fuzzy Hash: 122e0262c911d044cd346cb8dc6bc87f68950fa70168cc56b92e0639e1e06e69
Instruction Fuzzy Hash: DD51F970B102548FEF65776DD95472F269FDB89350F104926E90ACF3AADA2CCC458392

Function 06A1FA58 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68608b8740b168c4bda2faeac898825edd996a973c7fd4d1d8636ecd654e0ccf
Instruction ID: c8cf55b62d0d18f58d9737c9bf18d38c72d22dcb5d8a76a792a1f00d9542f75a
Opcode Fuzzy Hash: 68608b8740b168c4bda2faeac898825edd996a973c7fd4d1d8636ecd654e0ccf
Instruction Fuzzy Hash: A9511970B102548FEF65776DD95472F269FD789350F20092AE90BCF3AADA2CCC458392

Function 06A1551A Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51abd0d39986d6e44e6c88befd2d7a771e4ca449036448a90f4efb9a0dc8d25b
Instruction ID: e0a2ab573a25cf184a57fe1f998f72a10ed8dbb7352a84172c0f189c03c54b83
Opcode Fuzzy Hash: 51abd0d39986d6e44e6c88befd2d7a771e4ca449036448a90f4efb9a0dc8d25b
Instruction Fuzzy Hash: EF416FB1E006098FDF70DFA9C880AAFFBB2EB95310F14492AD155DB650D731E945CB91

Function 06A15698 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b3fec386b52a3338e85d16864b39d4216615fa5049bc897e037eeee34032e5e
Instruction ID: f411b6b17e56f03dae7808c178b73ebceb102efc24fb06c0c57483a111a755df
Opcode Fuzzy Hash: 1b3fec386b52a3338e85d16864b39d4216615fa5049bc897e037eeee34032e5e
Instruction Fuzzy Hash: 9531B2B5E102098FDF60AF69C4C06AEFBB1FBC5320F25892AD469DF251C234E941CB91

Function 06A1DA59 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368536c99f870d00b22bb2bdef6fbeb453c7d0ea2a98c6fe1c6eb81fb09e84d3
Instruction ID: 5b853a69eed3394949f2dcddc423d3ade64cced2db9366803f167b34a194e3f4
Opcode Fuzzy Hash: 368536c99f870d00b22bb2bdef6fbeb453c7d0ea2a98c6fe1c6eb81fb09e84d3
Instruction Fuzzy Hash: 1F31E630A0431A8FCF64EFA9D480A8EB7B6FF85304F108529E505EF214EB70E946CB81

Function 06A12089 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759b6b7c1229992e1cb257c403d3300bee4596d6cbc6b6a4c79e4088004855e8
Instruction ID: 4e85bbf684baf178dd26fba6013b8831dfab21e19d1527090669acce5cabdffb
Opcode Fuzzy Hash: 759b6b7c1229992e1cb257c403d3300bee4596d6cbc6b6a4c79e4088004855e8
Instruction Fuzzy Hash: BA319234E002159BCB59DF65D99469EB7F2FF89300F108919E906EB350DB71ED46CB90

Function 06A12098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b387a9de5ed412f96783e5850a480cf30686215aa360383a627fdcccdd58315
Instruction ID: 678a856971e135ce63b016c31bdbdd912438f6eeb0f4e0d6e40a9991c18f2627
Opcode Fuzzy Hash: 4b387a9de5ed412f96783e5850a480cf30686215aa360383a627fdcccdd58315
Instruction Fuzzy Hash: C231A030E002158BCB59DF65D95469EB7F2FF89300F108929E906EB350DB71ED82CB90

Function 06A16558 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7029deb84dd7532c8c50274759d4fe9158253f5141aaed0ff73d2de89ae1426
Instruction ID: 8d56fde45b2f8457e1b75b14599226149d3427f0465136b54cf76b633d6c526b
Opcode Fuzzy Hash: e7029deb84dd7532c8c50274759d4fe9158253f5141aaed0ff73d2de89ae1426
Instruction Fuzzy Hash: D1317CB1D012199FCB10DFA9C985BDEFBB8FB09324F10816AE418EB241D3759940CBA4

Function 06A13FA8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26cd180874fad6e7fd29a1343329720b80fcf1724da68887b34496f52e5a4469
Instruction ID: fdc8d93fb47ae7e7e46b27f9cb0b0fe7f1a0770b38dd5ba934ca1f941547e4ab
Opcode Fuzzy Hash: 26cd180874fad6e7fd29a1343329720b80fcf1724da68887b34496f52e5a4469
Instruction Fuzzy Hash: 83218B71F00219AFDB50DF79E841AAEBBF5EB48710F144029E945EB358E735D802CBA1

Function 06A13FB8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba261fb816b4873c6dc23ab5066cf6f481795d2c82856e47cc7e63c36e5548b1
Instruction ID: b42745c89ae3c124c3cdb5004aeecbec7e9f239d28d76ec2d8d03f92ed236190
Opcode Fuzzy Hash: ba261fb816b4873c6dc23ab5066cf6f481795d2c82856e47cc7e63c36e5548b1
Instruction Fuzzy Hash: F3218E75F002199FDB50EF69D880AAEB7F5FB48710F104025E915EB354E735D901CB91

Function 06A1A3E2 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ccb45d8dba52c9be0f37b69dd6b13e1b72db44f11ccbc834750e0b47761c102
Instruction ID: c54d528cfe6cd6fde222c88d376de999c37b6d86993c485e36db7cccb9204127
Opcode Fuzzy Hash: 1ccb45d8dba52c9be0f37b69dd6b13e1b72db44f11ccbc834750e0b47761c102
Instruction Fuzzy Hash: C8113B35B021244FCB51FBB8E5546AEB7F2EB86315B10856AE20ADF211DA31DD06CB81

Function 0144D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4502200818.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_144d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb6424b44f070d68f0f28ed4fbca4d566bec991083a0180145a295944f82092
Instruction ID: c43d8134a3ff26637dc68b5bf49b1dfd5856444aa0672376cd5ade74eac1b78c
Opcode Fuzzy Hash: ccb6424b44f070d68f0f28ed4fbca4d566bec991083a0180145a295944f82092
Instruction Fuzzy Hash: 052125B1904204DFEB15DF98D980B26BBA5FB94318F20C56ED90A0B366C33AD407CA62

Function 0144D118 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4502200818.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_144d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7179220439985a1589b002891ecc5a411638955c962cb4be67df4b0992869ddc
Instruction ID: 2273e87ba1064bd2f9ad0a085abd4a508933ac3ab7e210c0cc5084b335485b01
Opcode Fuzzy Hash: 7179220439985a1589b002891ecc5a411638955c962cb4be67df4b0992869ddc
Instruction Fuzzy Hash: 0721F271A04204DFEB05DF58C9C0B26BF65FB94314F24C5AEDD094B366C33AD846C661

Function 0144D006 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4502200818.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_144d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d401107a71d16e838e9c075c4225ca3aa4d2689b23b6dcf2e540a1ffc272a566
Instruction ID: 837d35d6291e7462ba205a9314626a2599c3f1532df0181b539c3a9208b8312c
Opcode Fuzzy Hash: d401107a71d16e838e9c075c4225ca3aa4d2689b23b6dcf2e540a1ffc272a566
Instruction Fuzzy Hash: C5216B7550D3C08FDB13CF64C990711BF71AB46214F29C5EBD9898F6A7C23A980ACB62

Function 06A16DF8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba31ecf1d626750daac80bd176a920e8f9f257eb6dd2a78b5484666e8d5806b
Instruction ID: a975bcc16560c32cfe671380c7bd603bf7fd22cf95598c5d14d47a93ebe257ff
Opcode Fuzzy Hash: aba31ecf1d626750daac80bd176a920e8f9f257eb6dd2a78b5484666e8d5806b
Instruction Fuzzy Hash: 8021E130B001199FDF44EB6AE9506AEB7B7EF85310F148529E509EF394EB30ED028B84

Function 06A14300 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c035a17544a97d4f1da2e5c8c90e7718650c5a41527de9b7c299cafe048f402
Instruction ID: 97735cfef86b57c97f06b03bdcb136be7761fcfbd7320430a759cb9f1bc9aae3
Opcode Fuzzy Hash: 2c035a17544a97d4f1da2e5c8c90e7718650c5a41527de9b7c299cafe048f402
Instruction Fuzzy Hash: 2101D271B002211FD795AA6DE80075FFAEBDBC9711F10443AE10ACF351EA21DD034391

Function 06A140C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df156613c9ab821ec3668399e164d017619eaab42864e8dd39cf7aa9532e3983
Instruction ID: 80e8132091f6b659f9344d41f8adbe5516f2d108da0f3ec890142c6c9dbe0b98
Opcode Fuzzy Hash: df156613c9ab821ec3668399e164d017619eaab42864e8dd39cf7aa9532e3983
Instruction Fuzzy Hash: D0118E32B001294BDB54A66CD8246AE73FBEBCC351F018539D50AEB354DA25DC068BE1

Function 06A1AFF8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a07d203d96fb8d591faad7981e483056f2fdbd3593bb665c12a60057a905539e
Instruction ID: f3dd6382d3f60f9dd27e0db5f6750cb796bc8e0b91e697cd0c5ac0f5fe3f7771
Opcode Fuzzy Hash: a07d203d96fb8d591faad7981e483056f2fdbd3593bb665c12a60057a905539e
Instruction Fuzzy Hash: 85115171D1076E9BCF61DFA5C85069EBBB6BF85340F11451AE805FF200EBB0A949CB91

Function 06A140B7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6946c5ab16ba687fb6039e28f3ad9086f0b503dda4d51e1e5a03abffe2b8b15
Instruction ID: 687da697e2fe510d238a21f9661042623f1934aa20c187f6710bf2c0a57a6f0d
Opcode Fuzzy Hash: d6946c5ab16ba687fb6039e28f3ad9086f0b503dda4d51e1e5a03abffe2b8b15
Instruction Fuzzy Hash: E6019632B001255BDB55A67CDC146EF77FBDBC9710F11403AD50ADB254DA258C0B87E2

Function 06A13D80 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8993c51fa4b712ee51dde9f8fab38d35502b38862f54cc8004eb9a37ef8b075
Instruction ID: aa2c20d35f335212a772b29441683d57bf20520015d6d0bbafaed14340892854
Opcode Fuzzy Hash: a8993c51fa4b712ee51dde9f8fab38d35502b38862f54cc8004eb9a37ef8b075
Instruction Fuzzy Hash: FC21C3B5D01259AFCB10DF9AD884ADEFFB4FB49320F10811AE918A7240D3786A54CFE5

Function 06A1F287 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11341184175f6ebd6b665f10413077aaf6b15416a556aca4622c0eea79db70e8
Instruction ID: 8a16950e288cd8929c903f78496689ff45df35ec1d12eb7bd5e65d77e1ac1ec6
Opcode Fuzzy Hash: 11341184175f6ebd6b665f10413077aaf6b15416a556aca4622c0eea79db70e8
Instruction Fuzzy Hash: 0601A235B000615FDF65A7B9A4A476EA7D6DBC9721F10883AE10ACF344EE21DD4347D1

Function 0144D113 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4502200818.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_144d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction ID: f951c5ce6568e63f14a1560c31aeea201c4dadf21ef4e5c0d148c28069906e92
Opcode Fuzzy Hash: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction Fuzzy Hash: 8B11BE75904280CFEB06CF14C5C4B16BF62FB54214F24C6AADC494B762C33AD44ACB51

Function 06A13D88 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3821c50f8ec9463ec9e31159e3d75ab904af46b73e6655a11e419d68e09a38
Instruction ID: bd209d8be0534a6e607964a5b33a6dc29e36766b31a27e23007bac338b1c6c3b
Opcode Fuzzy Hash: 3f3821c50f8ec9463ec9e31159e3d75ab904af46b73e6655a11e419d68e09a38
Instruction Fuzzy Hash: C011A2B5D01259AFCB10DF9AD884ADEFFB4FB49314F50812AE518A7240C3786954CFE5

Function 06A14310 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5432073a3ed1491eff2eb313463f1ad4900d558a58740d0ca318471d273432a5
Instruction ID: 4672aa7b357297dab43d9d24146fc55ca1940d20108edb2b8c57802509aa69a4
Opcode Fuzzy Hash: 5432073a3ed1491eff2eb313463f1ad4900d558a58740d0ca318471d273432a5
Instruction Fuzzy Hash: 1C016D31B005210BDB65AA6DE45472FF6DBDBC9B11F108839E10ECF354E965DD034395

Function 06A1F298 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afec6ddda3cb3cf4dbb2ca530f914e45946b3113de32590069a1b4f58bad17c0
Instruction ID: 11791b705ef7a91898f19064f231eafa4ea475bb03a60f47b0147092ca6e37da
Opcode Fuzzy Hash: afec6ddda3cb3cf4dbb2ca530f914e45946b3113de32590069a1b4f58bad17c0
Instruction Fuzzy Hash: A2018135B001610FCB65AA7DE464B2FB6DADBC9625F10883AE10ACF344DA65DD034396

Function 06A1A3F0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7cd52f71a9a7dfb96dfa3ca14c836dfdf327f8b7c974a7cdad3a7e3a3424511
Instruction ID: 6ce7978f305ac533b79c7c43a0702ae4bb45bca90716b8f2534532a92898bb10
Opcode Fuzzy Hash: f7cd52f71a9a7dfb96dfa3ca14c836dfdf327f8b7c974a7cdad3a7e3a3424511
Instruction Fuzzy Hash: 08018130B115240BDB65EA69E454B2EB3D6EB89764F108839E60ECF354EE21ED028B81

Function 06A1C8C0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b69b88b8481c75d734fbb32812cceade62f01550b303a1186f0d271f5ccb2a4
Instruction ID: 8d7d71004b117864a8f17c6c3891534cb13180ec6870f9ee017e6568c5a7e500
Opcode Fuzzy Hash: 6b69b88b8481c75d734fbb32812cceade62f01550b303a1186f0d271f5ccb2a4
Instruction Fuzzy Hash: A501F931B112245BCF15AE66F850A9EB77AEB84320F004139E906EF344DB35A8058BD4

Non-executed Functions

Function 06A17780 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A17D01
$]q, xrefs: 06A17C62
$]q, xrefs: 06A178CA
$]q, xrefs: 06A178D6
$]q, xrefs: 06A17D17
$]q, xrefs: 06A17899
$]q, xrefs: 06A17C56
$]q, xrefs: 06A178A5
$]q, xrefs: 06A17CF5
$]q, xrefs: 06A17D0B

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 5bf0a13060bd68e16bef6df007880c771f835a516a076f1920b7e084040a8d1c
Instruction ID: 9f650b5d4c21ee04ff1dfd650a2444c5440aa7b37bb2cc9ff43c6e61f0bfdbd2
Opcode Fuzzy Hash: 5bf0a13060bd68e16bef6df007880c771f835a516a076f1920b7e084040a8d1c
Instruction Fuzzy Hash: DA121C30E002198FDB68EF69D994AADB7F2BF88304F249569D409AB354DB30DD85CF91

Function 06A1AA10 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A1ABCE
$]q, xrefs: 06A1AB98
$]q, xrefs: 06A1AB06
$]q, xrefs: 06A1ABC2
$]q, xrefs: 06A1AB61
$]q, xrefs: 06A1AB6D
$]q, xrefs: 06A1AB8C
$]q, xrefs: 06A1AB12

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 333258c36bc60f841b58cc965f8ee6aa8ec3359d03017f33e364fb7496529b3e
Instruction ID: 7ab8e1a9cd16f98e5f6e4d504a7103454758847caaade4b3df36c09860435b99
Opcode Fuzzy Hash: 333258c36bc60f841b58cc965f8ee6aa8ec3359d03017f33e364fb7496529b3e
Instruction Fuzzy Hash: E2917D30A022099FEB68EFA5E594B6EB7F6FF44301F108529E9059F3A5DB349C41CB90

Function 06A17180 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

.5uq, xrefs: 06A171DB
$]q, xrefs: 06A17462
$]q, xrefs: 06A174BC
$]q, xrefs: 06A17694
$]q, xrefs: 06A174C8
$]q, xrefs: 06A1761C
$]q, xrefs: 06A17688

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 68619dea9e2d7bd1c66d2d03b91427ac4a2020996d426486f770dfb8a3b9c00d
Instruction ID: 2b98c8fcc1bfb770c8c19492934378cb8a0f5a3e530cbb5c9669cf667df73ecf
Opcode Fuzzy Hash: 68619dea9e2d7bd1c66d2d03b91427ac4a2020996d426486f770dfb8a3b9c00d
Instruction Fuzzy Hash: CFF14C34A01209CFDB59EFA5E590A6EB7B7FF84300F218569E4159B368DB34EC42CB91

Function 06A184B8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A18783
$]q, xrefs: 06A18777
$]q, xrefs: 06A1871E
$]q, xrefs: 06A18712

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: a12edc3a91f09aa1900f4bf48ee911bb6705392fd1df3c850699d6802fb28c92
Instruction ID: db370fb84a15c87944bf730da377099e833998faad7b78fd641db8abf0157e03
Opcode Fuzzy Hash: a12edc3a91f09aa1900f4bf48ee911bb6705392fd1df3c850699d6802fb28c92
Instruction Fuzzy Hash: 17B13B30E012198FDB58EFA9D59066EB7B6FF84305F248929D406AF354DB39DC82CB90

Function 06A188D0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A1894F
LR]q, xrefs: 06A18A12
LR]q, xrefs: 06A189C3
$]q, xrefs: 06A1895B

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: 66329a3888e380cad61e45ab82fc96dfdb7fe74d0cbaf2bb1a859f70746cdf7e
Instruction ID: 8716fd6118af6ecf066085417670c62ef6b6e6d90e3770073568e6f354a9df9c
Opcode Fuzzy Hash: 66329a3888e380cad61e45ab82fc96dfdb7fe74d0cbaf2bb1a859f70746cdf7e
Instruction Fuzzy Hash: 3C51B130B002059FDB58EF29D990A6AB7F6FF88310F118569E4069F3A8DA34EC41CB91

Function 06A1AD9A Relevance: 5.2, Strings: 4, Instructions: 165COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A1AF74
$]q, xrefs: 06A1AF1C
$]q, xrefs: 06A1AEC9
$]q, xrefs: 06A1AF4B

Memory Dump Source

Source File: 00000005.00000002.4507686785.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a10000_jsc.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: f8869dcd28d4e38cc15f5d25030ecb1599728b570d06493d88aae219c449ec4b
Instruction ID: d34d925095f302f160f7f1956bd6a583dd84e3b8d07e8a9e45b1833cfbdce139
Opcode Fuzzy Hash: f8869dcd28d4e38cc15f5d25030ecb1599728b570d06493d88aae219c449ec4b
Instruction Fuzzy Hash: FB51A130A122148FDF65EF68E580AAEB3B6EF89310F148529E915DF354DB30DD42CB91

Analysis Process: newapp.exePID: 7508, Parent PID: 1028COMMON

Executed Functions

Function 00E90E39 Relevance: 2.6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

tP]q, xrefs: 00E90E62
tP]q, xrefs: 00E90EEB

Memory Dump Source

Source File: 0000000B.00000002.2170697262.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e90000_newapp.jbxd

Similarity

API ID:
String ID: tP]q$tP]q
API String ID: 0-145478062
Opcode ID: ec4c1290d6e6bb24930c44aace2f5a85b8ef7e2b825c6abb2846bc9e9b31c40e
Instruction ID: 27cddfdc328fc656e00f1f1bf782a109f5cb6e6a25137fe922940365c2fb5683
Opcode Fuzzy Hash: ec4c1290d6e6bb24930c44aace2f5a85b8ef7e2b825c6abb2846bc9e9b31c40e
Instruction Fuzzy Hash: 62214874B001158FCB48DFB9C448AADBBF1AF48B14B2145A9E509EB361DB35ED42CF91

Function 00E90E48 Relevance: 2.6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

tP]q, xrefs: 00E90E62
tP]q, xrefs: 00E90EEB

Memory Dump Source

Source File: 0000000B.00000002.2170697262.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e90000_newapp.jbxd

Similarity

API ID:
String ID: tP]q$tP]q
API String ID: 0-145478062
Opcode ID: 48f0c1deef44f66feb30239615bc60e5f7dad59ce78980ada6789c8006b43378
Instruction ID: 2165cc770ed48ddacb31a529d35e4d107312b1d704917313528da37f6d4f096e
Opcode Fuzzy Hash: 48f0c1deef44f66feb30239615bc60e5f7dad59ce78980ada6789c8006b43378
Instruction Fuzzy Hash: DB212474B001158FCB48DFB9D488A6DB7F1AF48714B2145A9E509EB361EB35ED42CF90

Function 00E904D4 Relevance: 1.8, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

l.]q, xrefs: 00E908D2

Memory Dump Source

Source File: 0000000B.00000002.2170697262.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e90000_newapp.jbxd

Similarity

API ID:
String ID: l.]q
API String ID: 0-1248894718
Opcode ID: 4783800c767486631ff9a69fec49a9de367cf3543448be84ecca1c0f9e236a40
Instruction ID: 3c31381e79e8911ecfeb4a95042b1174052d2c99bf47cccce6317d44c656f50c
Opcode Fuzzy Hash: 4783800c767486631ff9a69fec49a9de367cf3543448be84ecca1c0f9e236a40
Instruction Fuzzy Hash: 0C31C030B002048FCB18EF79D954A6A3BEAFF89710F115969D10ADB366DB34DC05CB91

Function 00E90848 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

l.]q, xrefs: 00E908D2

Memory Dump Source

Source File: 0000000B.00000002.2170697262.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e90000_newapp.jbxd

Similarity

API ID:
String ID: l.]q
API String ID: 0-1248894718
Opcode ID: 43782734e23efe3c680bbbf63422c608d50a86a5efea68f33d49fb90e855c515
Instruction ID: 7828a8f619e89f8cd94e7241c2f015c287e555aa2fd8bdaa53ee4bcecd3eeb9d
Opcode Fuzzy Hash: 43782734e23efe3c680bbbf63422c608d50a86a5efea68f33d49fb90e855c515
Instruction Fuzzy Hash: C6316A30B002048FCB58EF79D954A6A7BEAFFC9710B619868D50ADB366DB349C05CB91

Function 00E90E82 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

tP]q, xrefs: 00E90EEB

Memory Dump Source

Source File: 0000000B.00000002.2170697262.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e90000_newapp.jbxd

Similarity

API ID:
String ID: tP]q
API String ID: 0-2175968468
Opcode ID: 7b404212367e9efe402765459c0c3a987c18f3adaa0e2ca254bc9fad285eaa3f
Instruction ID: 82ed7938833e1878677d11dfee7c389ab636638d49123de523f2389ec59d7aae
Opcode Fuzzy Hash: 7b404212367e9efe402765459c0c3a987c18f3adaa0e2ca254bc9fad285eaa3f
Instruction Fuzzy Hash: 6D111074B40115CFCB58DF78D08896DB7B1AF48719B2140A9E80ADB371DA35ED42CF80

Function 00E90F28 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2170697262.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e90000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f587e44c67ba02297b62cbee408a50316e6c118bf55f5a47f46ffc377021fd9
Instruction ID: 7ec1352ec375ef6dbcf31c341c6e9f91a7b510ba8a2cd27a1dcb5503460aa188
Opcode Fuzzy Hash: 5f587e44c67ba02297b62cbee408a50316e6c118bf55f5a47f46ffc377021fd9
Instruction Fuzzy Hash: 20216F75B002199FCF60DF79D880AAEB7F9EB8C714F64812AE519F3344DA309D0687A1

Function 00E90964 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2170697262.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e90000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c85b855f36b6ca7738f14c6cb2213a035200d8ef1dd889551a5c27091cf1986
Instruction ID: 6f7941a6c870316127d988fe8348facc2ffbaccea671435a2182e3cd55b07594
Opcode Fuzzy Hash: 2c85b855f36b6ca7738f14c6cb2213a035200d8ef1dd889551a5c27091cf1986
Instruction Fuzzy Hash: 0BE0867AB001148FCB00ABB8E818A5C7364FB8D71170104A5F909D7374DB348D06C741

Analysis Process: newapp.exePID: 7720, Parent PID: 1028COMMON

Executed Functions

Function 02700E39 Relevance: 2.6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

Strings

tP]q, xrefs: 02700EEB
tP]q, xrefs: 02700E62

Memory Dump Source

Source File: 0000000E.00000002.2252289992.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2700000_newapp.jbxd

Similarity

API ID:
String ID: tP]q$tP]q
API String ID: 0-145478062
Opcode ID: c35ba8e95ea86e9e727d48f71f495e110baae7d9616d2682bb1fdfcde2682de9
Instruction ID: 75740d5e926660d854af5dd47fa432fc82ccae69ced2dc53fd21de0124aa9d20
Opcode Fuzzy Hash: c35ba8e95ea86e9e727d48f71f495e110baae7d9616d2682bb1fdfcde2682de9
Instruction Fuzzy Hash: 0D214674A00115CFCB48DF79D484AADB7F1EF48B14B1145A9E409DB3A1DB359D46CF80

Function 02700E48 Relevance: 2.6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

tP]q, xrefs: 02700EEB
tP]q, xrefs: 02700E62

Memory Dump Source

Source File: 0000000E.00000002.2252289992.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2700000_newapp.jbxd

Similarity

API ID:
String ID: tP]q$tP]q
API String ID: 0-145478062
Opcode ID: 2dd939d9c0155ce3972da9692703aab54f27e944d830ce8a370c2116891e28d8
Instruction ID: cc152d2ae6aacf144c96d1c2cc1f7c711b8751164f93d24af995e09cec94e08a
Opcode Fuzzy Hash: 2dd939d9c0155ce3972da9692703aab54f27e944d830ce8a370c2116891e28d8
Instruction Fuzzy Hash: 06211374A00115CFCB48EFB9D488A6DB7F1AF48B14B1144A9E509DB3A1EB35ED46CF90

Function 027004D4 Relevance: 1.8, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

l.]q, xrefs: 027008D2

Memory Dump Source

Source File: 0000000E.00000002.2252289992.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2700000_newapp.jbxd

Similarity

API ID:
String ID: l.]q
API String ID: 0-1248894718
Opcode ID: 2450db6703314d8259ee98c084790a1dcf4fa67fa525b2f793806bd9d89efd65
Instruction ID: 0091850f9adc59e42966bff841684ba6dcc6ebea884a85092474822439bbe5a8
Opcode Fuzzy Hash: 2450db6703314d8259ee98c084790a1dcf4fa67fa525b2f793806bd9d89efd65
Instruction Fuzzy Hash: D4316D34B00200CFCB14EB78D994A6A7BF6FF89B14B1049ADD14A8B3A6DB349805CB51

Function 02700848 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

l.]q, xrefs: 027008D2

Memory Dump Source

Source File: 0000000E.00000002.2252289992.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2700000_newapp.jbxd

Similarity

API ID:
String ID: l.]q
API String ID: 0-1248894718
Opcode ID: f97940d7d523bce2a16774106ab8297cf890f6841359aa23bfe64f2388ab8708
Instruction ID: 450ede5941c41b69084451f7d279af05ba2c4e4bb12e7d7e82ec16561dd4c25d
Opcode Fuzzy Hash: f97940d7d523bce2a16774106ab8297cf890f6841359aa23bfe64f2388ab8708
Instruction Fuzzy Hash: 2F314E34B00204CFCB58EF79DA94A6A77E6FF89B10B104968D14ACB3A5EB349C05CB91

Function 02700E82 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

tP]q, xrefs: 02700EEB

Memory Dump Source

Source File: 0000000E.00000002.2252289992.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2700000_newapp.jbxd

Similarity

API ID:
String ID: tP]q
API String ID: 0-2175968468
Opcode ID: 6e3f9fb29e549dd2f9589920c0c96d98121fd3422b0f18d8e924ccd9706e6b1e
Instruction ID: db35b8b94daafa850f409d42796c470ed4b12ac523cc78c5a83392d4be8b2bb6
Opcode Fuzzy Hash: 6e3f9fb29e549dd2f9589920c0c96d98121fd3422b0f18d8e924ccd9706e6b1e
Instruction Fuzzy Hash: E011FD78A40115CFCB48DF78D088A6DB7B1AF48B25B2140A9E806CB3B1DB35EC42CF90

Function 02700F28 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2252289992.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2700000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb61ce9e11dbf494071cf15d0c342366928d30500e52998905e7e488c5f92a7
Instruction ID: b273e60e6ec0dd8688f20ce4805137d9d46bb2c5dbbe0b36753a24529923d762
Opcode Fuzzy Hash: feb61ce9e11dbf494071cf15d0c342366928d30500e52998905e7e488c5f92a7
Instruction Fuzzy Hash: 6C219575B00204DFCB50DE79D980BAEB7F5EB89724F10412AE519E7384DB30AC068BA1

Function 02700F19 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2252289992.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2700000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff47d790c38bcfd45163f99a2f63a385600fe02bbb7fe5de0c01984f4ba38e5b
Instruction ID: 3fbccd5daed1f715e5c84b159b694ce164523282e5cb2ee1d30ebf7fbe6e0439
Opcode Fuzzy Hash: ff47d790c38bcfd45163f99a2f63a385600fe02bbb7fe5de0c01984f4ba38e5b
Instruction Fuzzy Hash: 7E015E75A002149FCB51DF78A8C0FEEBBF1EB4A724F104265E918E7391D7319E169B90

Function 02700964 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2252289992.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2700000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd3c9765f9f071aeef8874b483613ec088428431ffd9c7661cfb85f0c2edaf0
Instruction ID: 4d8da2867fc92cb13fd7e5179ba453bbde1dcae77f3b9a94c93faf9eba322e95
Opcode Fuzzy Hash: 6cd3c9765f9f071aeef8874b483613ec088428431ffd9c7661cfb85f0c2edaf0
Instruction Fuzzy Hash: 6BE04F36B401108FCB04ABB8E41895C7374EBC862170108A5F909CB364DB388D55C741

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SPECIFICATIONS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SPECIFICATIONS.e_ac7470a4318affd3ab562a594613aefb5d44f54_b596bc7b_7f693ab5-20cd-47d5-ba8e-d10ca3bd5ef5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE724.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE88C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8EB.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newapp.exe.log

C:\Users\user\AppData\Roaming\newapp\newapp.exe

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
SPECIFICATIONS.exe

Function 00007FF848F1D44D Relevance: 2.8, Strings: 1, Instructions: 1566
COMMON

Function 00007FF848F12A2C Relevance: 1.7, Strings: 1, Instructions: 471
COMMON

Function 00007FF848F22D79 Relevance: 1.4, Strings: 1, Instructions: 173
COMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre